Data Broker permissions

Manage access to Cortex XSIAM Data Broker configuration and operations.

Data Broker permissions control access to the Broker VM infrastructure.

Broker Service

Manages Broker VMs that act as intermediaries for data collection from various sources. Brokers can host applets and other collection services. Go to Settings → Configurations → Data Broker → Broker VMs.

For more information, see Manage Broker VM.

Caution

Pathfinder Applet and Pathfinder Data Collection permissions have been deprecated.

IT Admin Role: IT Admins require full View/Edit access as they are responsible for the VM infrastructure and network connectivity.

Permission	Description	Roles Example
None	Cannot view or manage Broker VMs	SOC Tier 1 and 2 Analysts: Infrastructure management is not part of analyst duties.
View	Can view Broker VMs, their status, applet configurations, and clusters.	SOC Tier 3 Analyst: May need visibility into data collection infrastructure. Threat Hunter: May need to understand data collection sources,
View/Edit	Can create, configure, and manage Broker VMs, applets, and clusters.	Security Engineer: Responsible for data collection infrastructure and Broker management.

Required and recommended permissions

Managing Broker VMs effectively requires visibility into the data sources they collect from, the agents they interact with, and the infrastructure settings that govern them. Consider adding the following permissions:

Permission	Permission Level	Reason
Log Collections	View	Broker VMs are the primary infrastructure for log collection and need visibility into the collection status. Strongly recommended.
Data Sources	View	Understand data sources feeding through Broker VMs. Strongly recommended.
Agent Administrations	View	Brokers interact with agent infrastructure; agents connect through Brokers. Strongly recommended.
Auditing	View	Track changes to Broker configurations for compliance. Strongly recommended.
Cases & Issues	View	Broker issues may generate cases requiring investigation. Recommended.
Integrations	View	Brokers host integrations; need visibility into integration health. Recommended.
Alert Notifications	View	Syslog forwarding through Brokers is tied to notification configuration. Recommended.
Live Terminal	View	Remote terminal access to Broker VMs for troubleshooting. Recommended.
General Configuration	View	Server settings may affect Broker behavior. Recommended.
Query Center	View	Query Broker-related data for troubleshooting collection issues. Recommended.