LogoLogo
⌘Ctrlk
BlogSupport
  • Home
AI Assistant

I'm here to help you with the docs.

⌘Ctrli
AI Based on your context
LogoLogo
    • Navigate the Cortex XSIAM docs
    • Get started with Cortex XSIAM
    • Agentic AI in Cortex XSIAM
    • Cortex XSIAM license tiers and product licenses
    • In-product support ticket creation
    • Supported web browsers
    • Use the Cortex XSIAM interface
    • Manage API keys
    • How to onboard Cortex XSIAM
    • Plan and prepare
    • Deployment steps
    • Post-deployment
    • Configure Cortex XSIAM
    • Data management
    • Cortex XSIAM Data Sources and Connectors
    • Marketplace
    • Configure the Cortex Agentic Assistant
    • Cortex MCP server
    • Automations
    • Engines
    • Remote repository management
    • Customize cases and issues
    • XQL query management
    • Multi-Tenant
    • Managed Services configuration in Cortex
    • Endpoint security
    • Endpoint DLP
    • Monitor dashboards and reports
    • Investigation and response
    • Agentic Assistant chat
    • Asset management
    • Threat management
    • Attack surface management
    • Vulnerability management
    • Exposure management
    • Cortex Advanced Email Security
    • Identity Threat Detection and Response (ITDR)
    • Rules and Policies
    • Monitor and track compliance adherence
    • Cloud Data Classification
    • Cloud Identity Security
    • Network exposure detection
    • Cortex Cloud SaaS Security
    • Cortex Cloud AI Security
    • Serverless function posture security
    • Cortex Cloud Application Security
    • Registry scanning
    • Web and API Security (WAAS)
    • Serverless function runtime security
    • Cortex Data Security
    • Cortex XSIAM XQL
    • Graph Search
    • About Cortex CLI
    • Role-Based Access Control
      • Role permissions by component
      • Core tenant and administrative permissions
      • Configuration permissions
        • Auditing permissions
        • Alert Notifications permissions
        • General Configuration permissions
        • Cortex XDR Analytics permissions
        • Access management permissions
        • Data Broker permissions
        • Log Collection permissions
        • Data Sources permissions
        • External Issues Mapping permissions
        • Integrations - instance permissions
        • Integrations Permissions
        • Data Management permissions
        • Public API
        • Threat Intelligence permission - API configuration
        • Long-running HTTP Integrations configuration
        • Credentials permissions
        • Network Scanners permissions
        • Apps - Instance permissions
        • Object Setup permissions
      • Marketplace permissions
      • Help permissions
      • SOC Operations, Investigation & Response permissions
      • Dashboards and Reports permissions
      • Cases and Issues permissions
      • Investigation and Response permissions
      • Jupyter and Observability apps permissions
      • Threat Management permissions
      • Exceptions Configuration permissions
      • Managed Services permissions
      • Cortex Agentic Assistant permissions
      • Agents and endpoint protection
      • Inventory - Agent permissions
      • Data Security - Endpoint DLP permissions
      • Inventory - Assets permissions
      • Exposure and Vulnerability Management permissions
      • Cloud Security and Posture Management permissions
    • API documentation
    • Reference
    • Learn more about migrating to the latest broker VM image
    • Standalone Broker VM
    • Broker VM high availability cluster node
For the complete documentation index, see llms.txt. This page is also available as Markdown.
  1. Guides
  2. Cortex XSIAM
  3. Cortex XSIAM Documentation
  4. Reference and developer docs
  5. Role-Based Access Control
Cortex XSIAM

Configuration permissions

Learn about role permissions for Cortex XSIAM configuration components.

This section includes:

  • Auditing permissions

  • Alert Notifications permissions

  • General Configuration permissions

  • Cortex XDR Analytics permissions

  • Access management permissions

  • Data Broker permissions

  • Log Collection permissions

  • Data Sources permissions

  • External Issues Mapping permissions

  • Integrations - instance permissions

  • Integrations Permissions

  • Data Management permissions

  • Public API

  • Threat Intelligence permission - API configuration

  • Long-running HTTP Integrations configuration

  • Credentials permissions

  • Network Scanners permissions

  • Apps - Instance permissions

  • Object Setup permissions

PreviousCore tenant and administrative permissions
NextAuditing permissions

Last updated 1 month ago

Was this helpful?

LogoLogo

‍

  • Trust Center

‍

  • Privacy

‍

  • Terms of Use

‍

  • Legal

© 2026 Palo Alto Networks, Inc. All rights reserved.

Was this helpful?