> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md).
# Detection Rules permissions
**Detection Rules permissions**
You can limit permissions for Detection rules (**Threat Management** → **Detection Rules**), which include the following:
* IOC Rules: Indicator of Compromise rules that detect known malicious artifacts such as file hashes, IP addresses, domains, and URLs based on threat intelligence feeds.
* BIOC rules: Behavioral Indicator of Compromise rules that detect suspicious activity patterns using XQL queries to identify threats based on behavior rather than static indicators.
* Analytic rules: Machine learning and statistical analysis rules that detect anomalies and threats using the Analytics Engine for advanced behavioral detection.
* Correlations: Correlation rules that combine multiple events or conditions to detect complex attack patterns spanning multiple data sources or time periods.
* Indicator rules: Rules that automatically create IOC detection or prevention rules based on threat intelligence indicators matching specific criteria.
{% hint style="warning" %}
### Caution
Users must have View/Edit access to the Query Center if they are expected to create or edit BIOC and Correlation rules.
{% endhint %}
| Component | Description | Roles Example |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No access to Detection Rules. | |
| View | Read-only access to Indicator rules, IOC, BIOC, Correlations, and Exceptions pages. | SOC Tier-1 analysts: Understand what rules are triggering issues. |
| View/Edit | Full access to Detection rules, including creating, editing, deleting, and enabling rules.
When Rules is set to View/Edit, you can grant the following additional permissions:
- Prevention Rules: Blocks or stops suspicious or malicious processes on an endpoint.
- Request WildFire Verdict Change: Report a file’s WildFire verdict as incorrect and suggest a corrected classification.
| - SOC Tier 2 Analyst: Investigate cases and may need to create or modify detection rules based on findings. Should not manage prevention rules or request WildFire Verdict Change.
- SOC Tier-3 Analyst: Handles complex incidents and has the authority to manage prevention rules and request WildFire Verdict Change.
- Threat Hunter: Proactive threat detection specialists who search for hidden threats and create detection rules based on hunting findings. Should not manage prevention rules, but can Request WildFire Verdict Change.
- Security Engineer: Full access to build and optimize detection/prevention capabilities, including WildFire verdict change requests.
|
**Required and recommended permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Query Center | View/Edit | Required to edit BIOC and Correlation Rules. |
| Cases & Issues | View | Strongly recommended. Detection rules generate issues that appear in Cases & Issues. Without case access, analysts cannot see the issues triggered by the rules they are viewing, losing critical context for rule effectiveness assessment. |
| Threat Intelligence | View | Strongly recommended for Threat Intelligence (TIM): IOC rules are based on threat intelligence indicators. Without Threat Intelligence view, users cannot see the indicators that IOC rules are matching against, making rule review incomplete.
Required for Extended Threat Intelligence (XTI): Indicator rules are based on XTI indicators. Without Threat Intelligence view, users cannot use the indicators that indicator rules are matching against.
|
| Policies | View | Recommended. Prevention rules are assigned to policies. Viewing policies helps understand which rules are actively enforced on endpoints and their scope. |
| Global Exceptions | View | Recommended. Global Exceptions View provides visibility into exception rules that may suppress detection rule issues. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.