> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/query-center-permissions.md).

# Query Center permissions

Configure permissions for Query Center.

Controls access to the Query Center (under **Investigation & Response** → **Search**), which is the primary interface for writing, executing, and managing XQL queries in Cortex XDR. It is the core investigation tool that enables security analysts to search across all ingested data using a powerful query language. Key capabilities:

* Write and execute XQL queries against any ingested dataset.
* View query execution history and results.
* Schedule recurring queries
* Export query results

{% hint style="warning" %}

### Caution

Access to the Query Center is strictly governed by Scope-Based Access Control (SBAC). Even if users have View/Edit permissions, they will only see data returned from the endpoint groups or log sources defined in their specific role scope.
{% endhint %}

For more information, see [Overview of the Query Center](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/overview-of-the-query-center.md).

| Permission | Description                                                                                                                                                                         | Roles Example                                                   |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| None       | The entire Investigation section is hidden: Query Center, Query Builder, and Scheduled Queries are all inaccessible.                                                                |                                                                 |
| View       | Read-only access to the Query Center. Users can view query history, view scheduled queries, view active queries, and view individual execution results, but cannot run new queries. | Most viewer-type roles.                                         |
| View/Edit  | Full read and write access, including scheduling, canceling, running queries, deleting execution data, and deleting executions.                                                     | Most roles require query execution, scheduling, and management. |

**Required and recommended permissions**

To make the most of the Query Center capabilities, consider adding the following permissions:

| Permission     | Permission Level                 | Reason                                                                                                                                                                   |
| -------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Dashboards     | Enabled                          | Strongly recommended for the analyst to take an XQL query and **Save to Dashboard** to create a visual monitoring widget.                                                |
| Reports        | View/Edit                        | Recommended if the analyst needs to turn a search result into a scheduled PDF report for management.                                                                     |
| Query Library  | Enabled with checkboxes selected | Recommended to view saved queries.                                                                                                                                       |
| Dataset Access | N/a                              | Ensure the role's Data Scope includes the necessary pro-datasets (e.g., Cloud, Network, Endpoint) or the user will receive "No Results Found" even with a perfect query. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/query-center-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.