> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-actions-permissions.md).

# Configure actions permissions

Define how the Unit 42 Managed Services team operates within your environment by setting a permission level for each response action on each asset type.

The actions permissions matrix on the General tab governs eight response actions. Each action is configured independently for the Server asset type and the Workstation asset type, so stricter control scan be applied to higher-criticality assets.

**Permission levels**

There are three permission levels to choose from:

| Permission level | Description                                                                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Inform**       | Requires approval from your designated escalation contacts before any action is taken. No action will be performed until approval is received. |
| **No**           | Does not authorize our team to perform the specified action in your environment.                                                               |
| **Yes**          | Authorizes our team to act without prior approval.                                                                                             |

{% hint style="info" %}

### Note

When a permission level is set to **Inform**, configure at least one entry on the Escalation contacts tab so the Unit 42 Managed Services team can request approval before performing the action.
{% endhint %}

**Response actions**

Set the permission level for each of the response actions for **Server** and **Workstation**.

| Action                           | Description                                                                  |
| -------------------------------- | ---------------------------------------------------------------------------- |
| Retrieve endpoint files          | Extract files from a managed asset for forensic analysis.                    |
| Initiate live terminal           | Open an interactive terminal session on a managed asset for investigation.   |
| Isolate endpoint                 | Disconnect a managed asset from the network to contain a threat.             |
| Run endpoint script              | Execute a script on a managed asset for remediation or data collection.      |
| Destroy file                     | Permanently delete a file from a managed asset. This action is irreversible. |
| Retrieve technical support files | Collect system logs and diagnostic data from a managed asset.                |
| Terminate process                | Stop a running process on a managed asset.                                   |
| Quarantine files                 | Isolate a file to prevent execution while preserving the file for analysis.  |

The Unit 42 Managed Services team operates in accordance with the configured permission level for each response action on each asset type. Actions set to Inform trigger an approval request to the escalation contacts before execution. Actions set to **No** are not performed.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-actions-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.