CLI Tool permissions

Configure CLI Tool permissions in Cortex XSIAM.

CLI Tools (Cortex CLI) provides a unified command interface to efficiently scan Cloud Workload Protection (CWP), API Security, and Application Security environments with a single installation, enabling integration of security checks into development processes. It controls access to view the CLI Tools setup within the Data Sources & Integrations page (Settings → Data Sources & Integrations), download the CLI, and generate the required API keys.

Caution

• Licence Requirement: Accessing the CLI Tool requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
• This permission only governs the deployment and configuration of the CLI tool itself. To view the actual security findings and vulnerabilities discovered by the CLI scans, users must be granted separate access to the Application Security, Cloud Workload Policies, or Vulnerability Management modules.

Component	Description	Roles Example
None	No access to CLI Tools configuration or API key generation.	SOC Tier-1 Analyst: No need for CI/CD integration.
View	Read-only access to CLI Tools configuration and download capabilities.	SOC Tier-2 and 3 Analysts: May need to view scan results but not configure. Threat Hunter: May review scan results for threat intelligence.
View/Edit	Full access to configure CLI Tools and generate API keys for deployment.	Security Engineer: Configures CI/CD security integrations and needs to generate API keys.

Required and recommended permissions

To effectively configure the CLI and review its subsequent scan results, administrators and analysts require visibility into the underlying data sources and security policies. Consider adding the following permissions:

Permission	Permission Level	Reason
Public API	View/Edit	Required for setup. Users must generate an API key to configure the CLI tool successfully. As the backend endpoint is shared, View/Edit access to the Public API is mandatory.
Data Sources	View or View/Edit	View: Required. Access the Data Sources & Integrations page where CLI Tools is located. View/Edit: Strongly recommended to modify data source configurations.
CloudSec Policies	View/Edit	Required to access and modify the Cloud Workload Protection policies that the CLI evaluates against.
Application Security	View/Edit	Strongly recommended to view and manage the CI/CD, PR, and periodic scan findings generated by the CLI tool.
Vulnerability Management	View	Recommended to view broader vulnerability scan results identified by the CLI tool across the environment.