> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md).
# Host Insights permissions
Limits access to Host Insights/Inventory (**Inventory** → **Endpoints** → **Host Insights)**), which enables you to gain visibility and inventory into the business and IT operational data on all your endpoints. For more information, see [Host Inventory](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/host-inventory.md).
Unlike Forensics, which is a point-in-time snapshot, Host Insights is designed for broad fleet visibility and hygiene. It covers:
* Host Inventory: Operating system details, installed software, local user accounts, and listening ports.
* Searchability: The ability to hunt for "at-risk" systems across the environment (e.g., finding every server running an outdated version of Java).
{% hint style="info" %}
### Note
It is important to distinguish between Host Insights and Asset Inventory permissions. Host Insights is a deep insight into endpoints that have a Cortex XDR agent installed. Asset Inventory is a broad list of everything on your network (unmanaged devices, cloud buckets, etc.). For more information, see [Asset Inventory permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-inventory-permissions.md).
Accessing the **Host Inventory** menu (from **Host Insights**) provides different capabilities based on your license. If you have Cortex XDR Enterprise or Cortex XDR NG-SIEM with a Host Insights license, you have access to Vulnerability Assessment. For Cortex XDR Premium or Cloud Security (Posture/Runtime) licenses, you have access to Vulnerability Management. See [Vulnerability Management permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/vulnerability-management-permissions.md).
{% endhint %}
| Permissions | Description | Roles Example |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Limits access to the **Host Inventory** menu. | |
| View | Users can search the inventory, view host details, and browse software lists. They can open the Asset View but cannot trigger management actions. | - SOC Tier-1 Analyst: View host inventory and vulnerability data for triage.
- Security Engineer: View host data for detection development.
|
| View/Edit | Full access to the inventory, including the ability to manage scan settings or trigger manual inventory refreshes. | - SOC Tier-2 Analyst: View host data and escalate for file search/destroy.
- SOC Tier-3 Analyst: Full host insights, including file search and destroy.
- Threat Hunter: Full host insights for endpoint hunting.
|
**Required and recommended Permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| --------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Administrations | View | Host Insights displays endpoint/agent data. Without this, the host data will fail to load properly. Required. |
| Query Center | View | Strongly recommended to run queries on the host data. |
| Asset Inventory | View | Strongly recommended for the user to view Host Insights data directly within the broader Asset View for a seamless experience. |
| File Search | Checked | Dependency for file search action. Only needed if View/Edit permission is granted for Host Insights and the user needs to search for files across endpoints. |
| Destroy Files | Checked | Dependency for the destroy files action. Only needed if View/Edit permission is granted and the user needs to delete files from endpoints. This is an irreversible action; grant with caution. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.