> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/attack-surface-permissions.md).

# Attack Surface permissions

Attack Surface Management (ASM) identifies exposed assets, misconfigurations, and vulnerabilities on your organization's external-facing attack surface. This permission covers the following:

* Attack Surface Rules: Detection rules that generate issues when specific external exposures are found (e.g., exposed RDP, insecure SSH).
* Vulnerability Testing: An active scanning module that performs non-intrusive and intrusive tests against discovered services to validate CVEs and exposures, generating CVSS/EPSS scores.

**Attack Surface Rules**

Attack Surface Rules permission controls access to:

* **Modules** → **Attack Surface** → **Policies** → **Attack Surface Rules**.
* **Modules** → **Attack Surface** → **Global Lookup**
* **Posture Management** → **Rules & Policies** → **Policies** → **Attack Surface Rules**

{% hint style="info" %}

### Note

Requires an ASM, Exposure Management, or Cortex XSIAM Premium license.

If your organization does not have a Cortex XSIAM Premium license, users can only access Attack Surface features through the Modules menu. The Posture Management menu paths are not available.
{% endhint %}

| Permission | Description                                                                                                                                                | Roles Example                                                                                                                                                                                                                                                                        |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None       | No access to the **Attack Surface Rules** and **Global Lookup** pages.                                                                                     |                                                                                                                                                                                                                                                                                      |
| View       | <p>Read-only access to view all attack surface rules, their status, priority, and details.</p><p>The <strong>Global Lookup</strong> page is read-only.</p> | <ul><li>SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies.</li><li>Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.</li></ul> |
| View/Edit  | Full edit access to all view permissions, including enable/disable rules, update priority, and bulk-update policies.                                       | <ul><li>SOC Tier 3 Analyst: Senior analysts who can tune attack surface rules.</li><li>Security Engineer: Configures and tunes attack surface rules.</li></ul>                                                                                                                       |

**Vulnerability Testing**

Vulnerability Testing permission controls access to:

* **Modules** → **Attack Surface** → **Policies** → **Attack Surface Tests**
* **Settings** → **Configurations** → **Attack Surface** → **Attack Surface Testing** → **Attack Surface Testing Configuration**.

{% hint style="info" %}

### Note

Requires the Attack Surface Management or Cortex XSIAM Premium license.
{% endhint %}

| Permission | Description                                                                                                                                                                                                                                                                                                                                               | Roles Example                                                                                                                                                                                                                                                                        |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None       | No access to the **Attack Surface Tests** and **Attack Surface Testing Configuration** pages.                                                                                                                                                                                                                                                             |                                                                                                                                                                                                                                                                                      |
| View       | <p>The test results table is visible and read-only. Can view CVE details, CVSS scores, EPSS scores, and affected software.</p><p>Can see the <strong>Attack Surface Testing Configuration</strong> page from <strong>Settings</strong> → <strong>Configurations</strong> → <strong>Attack Surface</strong> → <strong>Attack Surface Testing</strong>.</p> | <ul><li>SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies.</li><li>Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.</li></ul> |
| View/Edit  | <p>Full access to the <strong>Attack Surface Tests</strong> page, including enable/disable tests, trigger manual scans.</p><p>Users have full access to the <strong>Attack Surface Testing Configuration</strong> page.</p>                                                                                                                               | <ul><li>SOC Tier 3 Analyst: Senior analysts who can tune attack surface testing.</li><li>Security Engineer: Configures and tunes attack surface testing.</li></ul>                                                                                                                   |

**Required and recommended permissions**

To effectively configure attack surface rules and active tests, administrators and analysts require deep visibility into the underlying asset inventory and the resulting security issues. Consider adding the following permissions:

| Permission               | Permission Level  | Reason                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------ | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Asset Management         | View              | Required for Attack Surface Rules and Vulnerability Management to access the asset inventory where tested services and rules reside.                                                                                                                                                                                                                                       |
| Cases & Issues           | View or View/Edit | <ul><li>View: Strongly recommended for Attack Surface Rules and Vulnerability Testing to view cases/issues generated from attack surface rules and vulnerability test findings.</li><li>View/Edit: Recommended for Attack Surface Rules and Vulnerability Testing if required to triage/respond to issues from attack surface rules/vulnerability test findings.</li></ul> |
| Attack Surface Rules     | View              | Strongly recommended for Vulnerability Testing. Provides visibility into the attack surface rules that define what is being tested. Helps users understand the context of vulnerability test results.                                                                                                                                                                      |
| Vulnerability Testing    | View              | Strongly recommended for Attack Surface Rules. Provides visibility into vulnerability test results that are related to attack surface findings. Useful for understanding the full context of an exposure.                                                                                                                                                                  |
| Vulnerability Management | View              | Recommended for Vulnerability Management. Provides access to the broader vulnerability management dashboards where test findings are aggregated into vulnerability issues. Useful for understanding the full lifecycle of a finding.                                                                                                                                       |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/attack-surface-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.