> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md). # Assign user roles and groups Assign roles directly to users or create user groups and assign roles to those groups. We recommend creating user groups (with a user role), and assigning users to those user groups rather than creating direct roles for each user. {% hint style="info" %} ### Note If an existing user in the Cortex Gateway no longer has a role or a user group assigned, the user is revoked. Any roles, user groups, or egress configurations created by that user are shown as created by **Revoked user** instead of the user’s email address. {% endhint %} ## Assign a user/user group to a role Cortex XSIAM provides predefined built-in user roles that provide specific access rights that cannot be modified. You can also create custom, editable user roles. If a user does not have any Cortex XSIAM access permissions that are assigned specifically to them, the field displays **No-Role**. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Edit User Permissions**.

To apply the same settings to multiple users, select them, and then right-click and select Edit Users Permissions.

3. Ensure the **Role** tab is selected. 4. Under **Role**, select the default or custom role. 5. (Optional) Under **User Groups**, add the user to a group. 6. (Optional) Under **Show Accumulated Permissions**: 1. Do one of the following: * Select all to view the combined permissions for every role and user group assigned to the user. * Select a specific role assigned to the user to view the available permissions for that role. 2. Under **Components**, expand each list to view the permissionsSetting Cortex Query Language (XQL) dataset access permissions for a user role can only be performed from **Cortex XSIAM Access Management**. For more information, see [Manage user roles](/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management.md#UUID-751d26ed-9390-dddd-d4f6-bb1f20db3a1d). 7. (Optional) You can configure and manage granular scoping: 1. Click the **Scope** tab. 2. Under **Scope Definition**, expand the scoping areas that you want to grant the user role access to in the tenant by clicking the chevron icon (**>**) beside the scoping area title, and make any changes required. The following table explains the options available to configure:

Before configuring, ensure that you review Understand scoping in the Manage user scope section.

| Scoping Area | Granular Scoping Configurations | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Assets |

Set the Scope by selecting one of the following:

The scoping of assets also affects the scoping of cases, issues, and findings.

Note

Visibility of Security domain Issues that refer to assets with agents is controlled by the Endpoints scoping configuration.

| | Cases and Issues |

Set the Scope by selecting one of the following:

When selecting All cases and issues or Select domains, you can separately configure access to issues and cases that lack an asset reference or where the referenced asset is not in All Assets and All Endpoints inventories. To provide access, select the Allow access to cases and issues that are not referencing known assets or endpoints checkbox. Once selected, you can specifically control which users have access to issues and cases that lack Affected Assets (as seen in the issue’s panel) and Assets (as seen in the case's panel), or where the listed assets are not part of the Asset or Endpoint inventories. When the assets listed are not part of the inventories, the asset string is typically non-clickable. In some cases, such as for identity-related issues, assets may open a dedicated User Risk View, which differs from the standard inventories panels. In the Issues and Cases tables, such items can be identified by empty values in the following columns: Asset IDs, Target Agent Identifier, and Source Agent Identifier.

| | Endpoints |

Set the Scope by selecting one of the following:

| | Datasets Rows |

Configure a filter to define the specific subset of rows a user is allowed to access in each raw dataset. A raw dataset is every dataset where Palo Alto Networks data is ingested out-of-the-box or third-party data is ingested using a configured dedicated collector, also called a data source. This filter configuration does not impact the visibility of cases and issues.

Follow these steps to configure a filter.

  1. For datasets where no filter is defined, determine how to set the When no filter is defined option as either:

    When defining a filter for row-level scoping on raw datasets, queries based on the Cortex Data Model (XDM) are not supported. XDM queries return specific rows only when All rows are accessible is selected and no filter is defined in the Datasets Rows scoping area. Otherwise, no rows are returned.

  2. Define any filters for the applicable datasets listed in the table:

    1. Scroll down the list of datasets to the dataset you want to apply a filter on, and click the Edit Scope icon.

    2. In the Define what rows are accessible window, continue to write the query for the filter in the query box (where the syntax is a limited subset of XQL) to limit the data rows for the selected dataset according to the access permissions you want the user to have. The beginning of the query is already defined before the query box, and there is no need to include this in your query.

      For optimal performance, we recommend using a single field in the filter definition and simple comparison operators.

      Supported syntax

      Fields

      You can define the rest of the filter in the query box, where only the following system fields are supported: \_broker\_device\_id, \_broker\_device\_ip, \_broker\_device\_name, \_collector\_id, \_collector\_ip, \_collector\_name, \_collector\_type, \_device\_id, \_final\_reporting\_device\_ip, \_final\_reporting\_device\_name, \_log\_type, \_product, \_scope, \_reporting\_device\_ip, \_reporting\_device\_name, and \_vendor.

      For more information on these fields, see the table that describes all the fields in the metrics\_source dataset and metrics\_view preset in Overview of data ingestion metrics. For more information on the \_scope field (relevant when \_scope is defined in the Parsing Rule), see \[Scenario 3: Supported fields don't provide the necessary segmentation] in Scenarios related to Datasets Rows scoping.

      Comparison operators

      The following comparison operators are supported:

      • Exact matches (=, !=)
      • Comparing numerical values (>, <, >=, <=)
      • Checking membership in lists (in)
      • Querying arrays (array\_contains)
      • Partial matches (contains, starts\_with): Using this operator has additional performance overhead, and we recommend avoiding its use.

      If you only want a user to be able to access rows in the pan\_dds\_raw dataset, when the \_collector\_name is bu2\_collector , you'd have to define the filter in the query box as:

      \_collector\_name = “bu2\_collector” |
      |
| | | | | | | | |


| |

Important

By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensures that the users, user groups, and API Keys defined in Cortex XSIAM are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.

8. Click Save. **Perform additional tasks** For more information about additional tasks such as creating a custom role, modifying a user's role, or removing a user's role, see [Manage user access](/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management.md#UUID-a112c99e-112f-ab8a-e5ed-e31445dee8fe). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.