Agent Scripts Library permissions

Manage Cortex XSIAM endpoint scripts for response, collection, and automation.

The Agents Script Library in the Action Center (Investigation & Response → Response → Action Center → Agent Script Library) enables security teams to create, manage, and execute Python scripts on endpoints for response actions, forensic collection, and custom automation.

Permission	Description	Roles Example
None	No access to the Agent Script Library. Users cannot run scripts on endpoints, access script execution history, create, edit, or delete scripts.
View	Users can access the Agent Script Library and view the script list, details, and code. Download the script code and definitions file and view the script history and results.	SOC Analyst Tier-1: Should have visibility into scripts and execution history, but no execution capabilities.
View/Edit	When set to View/Edit, the following action checkboxes become available: Run Standard Script Run High Risk Script Script Configurations	SOC Tier 2 and 3 Analysts, Threat Hunters, and Security Engineers should have full access with granular controls.

Agent Script Sub-permissions

Sub-permission	Description	Roles Example
Run Standard Scripts	Enables execution of standard scripts, which are lower-risk operations that don't make significant system changes, such as data collection, log retrieval, or read-only queries. Checked: Full access to run standard scripts in the Action Center (where the Outcome column is set to Standard), when defining an action (select Run Endpoint Script), Agent Management, and can rerun standard script executions and use interactive script mode for standard scripts. Unchecked: Can view standard scripts in the Agent Script Library, but cannot execute standard scripts.	SOC Tier 2 and 3 Analysts, Security Engineers, Threat Hunters.
Run High-Risk Scripts	Enables execution of scripts marked as High-Risk, which can make significant system changes, including file modifications, process termination, registry changes, or system configuration alterations. These scripts require elevated permissions due to their potential impact. Checked: Full access to run high-risk scripts in the Action Center (where the Outcome column is set to High-Risk), when defining an action (select Run Endpoint Script), Agent Management, and can rerun High-Risk script executions and use interactive script mode for standard scripts. Unchecked: Can view high-risk scripts in the Agent Script Library, but cannot execute standard scripts. Tip Consider adding Run Standard Scripts. High-risk scripts permission is typically granted alongside standard scripts.	SOC Tier-3 Analysts, Security Engineers, and Threat Hunters.
Script Configurations	Controls the ability to create, edit, clone, and delete scripts in the Agents Script Library. This is separate from the ability to run scripts. Checked: Full script management capabilities, including creating, editing, deleting, and saving a script Note Only local scripts (created in the tenant) can be edited or deleted. Scripts from content packs can only be viewed or copied. Unchecked: Can only view and download scripts.	Security Engineer

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reason
Action Center	View	Without Action Center access, users cannot reach the Script Library page. Required.
Cases & Issues	View	Strongly recommended as the script execution results link to cases.
Agent Administrations	View	Required for endpoint selection for script execution.
Live Terminal	View	Often used together. Run scripts for data collection and then use Live Terminal for hands-on investigation. Recommended.