> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md).

# Data Management permissions

Controls access to dataset configuration, data transformation rules, and data lifecycle management in Cortex XSIAM through **Settings** → **Configurations** → **Data Management**.

This permission includes:

* Dataset Management: For viewing and managing datasets
* Parsing Rules: For data transformation during ingestion
* Data Model Rules: For data normalization
* Event Forwarding: For sending data to external systems

This permission only offers None or View/Edit access. While SOC Tier-2, Tier-3, and Threat Hunters may need to view data schemas for advanced investigations, granting them View/Edit access gives them full control to alter parsing rules, modify datasets, and change ingestion pipelines. Grant this permission with caution and ensure proper change management protocols are in place.

| Permission | Description                                                                                                          | Roles Example                                                                                                                                                                                                                                                                                                               |
| ---------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | Users cannot access any Data Management configuration pages.                                                         | SOC Tier-1 Analyst: Data management configuration is outside Tier-1 responsibilities.                                                                                                                                                                                                                                       |
| View/Edit  | Full control over creating/managing datasets, modifying parsing rules, and configuring advanced ingestion pipelines. | <ul><li>SOC Tier-2 and 3 Analysts: May need to understand data schemas during investigations/advanced analysis.</li><li>Threat Hunter: May need to understand data schemas and transformations for hunting.</li><li>Security Engineer: Primary responsibility for configuring data pipelines and transformations.</li></ul> |

Required and recommended permissions

Consider adding the following permissions:

| Permission     | Permission Level | Permissions                                                                                          |
| -------------- | ---------------- | ---------------------------------------------------------------------------------------------------- |
| Public APIs    | View/Edit        | Compute Unit Usage page access; without this, the Compute Unit Usage page is inaccessible. Required. |
| Forensics      | View/Edit        | Data Export functionality; without this, the Data Export page is inaccessible. Required.             |
| Agent Profiles | View/Edit        | Some dataset operations reference profiles; needed for full context. Strongly recommended.           |
| Query Center   | View/Edit        | Running XQL queries against managed datasets. Strongly recommended.                                  |
| Data Sources   | View/Edit        | Understanding which data sources feed into managed datasets. Recommended.                            |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.