Threat Intelligence permissions

Configure permissions for Threat Intelligence.

Located under Threat Management → Threat Intelligence, these permissions govern how your organization interacts with indicators (IPs, URLs, Domains, Hashes) and intelligence feeds. It allows you to transform raw data from sources like Unit 42 or AlienVault into actionable security logic.

This feature requires the Extended Threat Intelligence (XTI) security add-on.

For more information, see Extended Threat Intelligence.

Component	Description
None	No access to the Threat Intel Library, Indicators and Threat Intel Dashboard.
View	Users can search the Threat Intel Library and Indicators, and view the Threat Intel Dashboard.
View/Edit	Full control to manage indicators and indicator rules.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission level	Reason
Cases & Issues	View	Strongly recommended. Indicator enrichment data appears in case artifacts, and editing indicators from case context requires case access.
Detection Rules	View/Edit	Strongly Recommended. Enables creating indicator rules directly from indicators.
Query Center	View/Edit	Enables investigating indicators via XQL queries. Essential for validating indicator impact before creating rules or blocking.