> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md).
# Exclusion List permissions
Control access to manage excluded threat indicators and their exclusion settings in Cortex XSIAM.
Controls access to the indicator exclusion list configuration under **Settings** → **Configurations** → **Object Setup** → **Indicators** → **Exclusion List**. This governs the permanent exclusion of indicators such as IP addresses, domains, URLs, file hashes, and email addresses. It is primarily used for:
* Allowing known-good or trusted infrastructure.
* Suppressing false-positive indicators identified during investigations.
* Filtering noisy vendor feeds that generate high volumes of low-value alerts.
{% hint style="info" %}
### Note
When managing Indicators (located under **Threat Management** → **Threat Intelligence** → **Indicators**), users who lack View/Edit permissions for the Exclusion List will find that exclusion-related features (such as the **Exclusion reason** field and **Do not add to exclusion list** checkbox) are automatically hidden by the system.
Access to the Indicators page itself requires a Threat Intelligence Management (TIM) add-on or a Cortex XSIAM Premium license.
{% endhint %}
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Users cannot view excluded indicators, add new ones, or perform imports/exports. | |
| View | Read-only access to the full table of excluded indicators, including values, types, and comments. Users can search, filter, and export the list. | SOC Tier-1 and 2 Analysts: Should be able to see what is excluded to understand why certain indicators are not flagged, but should not modify the list without approval. |
| View/Edit | Full read/write access. Users can manually add or remove indicators, perform bulk CSV imports/exports, and execute bulk operations. | - SOC Tier 3 Analyst: Can manage exclusions based on advanced threat analysis findings; trusted to add/remove indicators from the exclusion list.
- Threat Hunter: Critical for managing false positive indicators and tuning detection; threat hunters frequently need to exclude known-good indicators.
- Security Engineer: Manages exclusion lists as part of TI pipeline tuning and false positive reduction.
|
### Required and recommended permissions
Consider adding the following permissions:
| Permission | Permission Level | Reasons |
| -------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Threat Intel | View or View/Edit | - View: Required to view indicators that may need exclusion; required to see the Indicators section.
- View/Edit: Strongly recommended to manage indicators alongside exclusions (delete, edit indicators).
|
| Cases & Issues | View | Understand the context of indicators being excluded (which issues they triggered). Strongly recommended. |
| Integrations | View | View TIM feed integrations that generate the indicators being excluded. Recommended. |
| Audit | View | Track who added/removed indicators from the exclusion list. Recommended. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.