> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md).

# Application Security - Generic Collector permissions

The Generic Collector is a data source integration type within the Application Security module that allows ingestion of code scan data from external third-party security tools into Cortex XSIAM. Access the **3rd party AppSec Collector** data source by going to **Settings** → **Data Sources & Integrations**

Unlike built-in VCS integrations (GitHub, GitLab, etc.) and CI/CD integrations (Jenkins, CircleCI, etc.), the Generic Collector provides a flexible API endpoint for receiving scan results in supported formats (e.g., SARIF). Each collector instance is assigned a unique API URL and API key for external tool authentication.

{% hint style="info" %}

### Notice

Scan results ingested by the collector flow into Cortex XSIAM require a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license plus the Application Security add-on.
{% endhint %}

| Permission | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Roles Example                                                                                                                                                                                                       |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to the **3rd Party AppSec Collector** on the Data Sources page.                                                                                                                                                                                                                                                                                                                                                                                             | SOC Tier-1, 2, and 3 Analysts, and Threat Hunters: They do not need to create/modify collectors. None is appropriate.                                                                                               |
| View/Edit  | <p>Full access to create, configure, view, enable/disable, and delete the <strong>3rd Party AppSec Collector</strong> instances, provided users also have Data Sources View/Edit permission.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If users have View permission for Data Sources, they can view the <strong>3rd Party AppSec Collector</strong>, but cannot create or edit.</p></div> | Security Engineers: Responsible for configuring and maintaining the security tooling pipeline. They need to create new collectors, configure detection methods, manage API keys, and troubleshoot ingestion issues. |

**Required and recommended permissions**

The following permissions are needed alongside the Generic Collector permission for effective use. These apply generally regardless of role.

| Permission      | Permission Level  | Reason                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| --------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Data Sources    | View or View/Edit | <ul><li>View: The <strong>Data Sources</strong> page is the only path to access collector management. Without this permission, the user cannot reach the collector management interface, even if they have Generic Collector View/Edit. Required.</li><li>View/Edit: Creating, editing, enabling/disabling, and deleting collectors requires the Data Sources action permission. Without it, the user can only view collectors in read-only mode. Required.</li></ul> |
| Asset Inventory | View or View/Edit | <ul><li>View: To view the AppSec issues generated from collector-ingested data. Without this, the user can manage collectors but cannot see the resulting security findings. Strongly recommended.</li><li>View/Edit: To manage and remediate issues that originate from collector-ingested data (e.g., change issue status, assign issues, create exclusions). Strongly recommended.</li></ul>                                                                       |
| Integrations    | View/Edit         | <ul><li>View: View integration status and health for connected tools on the <strong>Data Sources & Integrations</strong> page. Recommended.</li><li>View/Edit: The <strong>Data Sources & Integrations</strong> page is shared between data sources and integrations. Having integration permissions provides a complete view of all connected tools. Strongly recommended</li></ul>                                                                                  |
| Query Center    | View & View/Edit  | <ul><li>View: Run XQL queries on data ingested through collectors for investigation purposes. Recommended.</li><li>View/Edit: Execute advanced queries on collector-ingested scan data. Recommended.</li></ul>                                                                                                                                                                                                                                                        |
| Cases & Issues  | View/Edit         | Correlate collector-sourced AppSec issues with cases and issues. Recommended.                                                                                                                                                                                                                                                                                                                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.