> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md).
# Live Terminal permissions
Live Terminal enables security teams to establish real-time interactive shell sessions with endpoints for investigation, forensic analysis, and remediation activities.
| Permission | Description | Roles Example |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Live Terminal | SOC Tier-1 Analyst: Initial triage role - should not have direct endpoint shell access. Risk of accidental damage or evidence tampering. Requires advanced skills they may not have
.
|
| View/Edit | Full access to the Live Terminal Investigation & Response → Response → Live Terminal, and to start a Live Terminal in all menus such as Casuality View, Asset View, Case View, and Broker VM. Users can do the following:
- Initiate terminal sessions
- File Explorer (browse, upload, download, delete files)
- Task Manager (view, terminate processes)
- Command Line (CMD, PowerShell, Python)
- All terminal capabilities
| - SOC Tier 2 and 3 Analysts: Perform deeper investigation needing direct endpoint access for evidence collection, process analysis, and targeted remediation.
- Threat Hunter: Needs direct endpoint access to investigate suspicious activity, collect artifacts, analyze processes, and validate threat hypotheses. Core hunting tool.
- Security Engineer: Troubleshoots agent issues, tests endpoint configurations, validates security controls, and supports complex case response.
|
**Required and recommended permissions**
Response actions require deep integration with the core platform to locate endpoints, track containment history, and link actions back to the active case. Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ----------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Management | View | Live Terminal is initiated from the Agent Management context menu. Without this, users have no way to browse and select endpoints. Required. |
| Live Terminal (Action Center) | View | Live Terminal actions are logged in the Action Center. Users need visibility into their session history and results. Recommended |
| Cases & Issues | View | Actions link directly to cases. Access is required to initiate response actions directly from the Causality View or Issue View context menus. Recommended. |
| Scripts | Enabled with checkboxes selected | Enabled with **Scripts** and **Create Scripts** selected. Required for the Action Center's Scripts tab to be visible, and required to execute items from the Agent Script Library. |
| Query Center | View | Recommended to view File Search results, investigate script executions, or add indicators to blocklists directly from XQL results. |
| Forensics | View | Complementary investigation tool. Forensic Timeline and Event Log Search provides context for Live Terminal activities. Recommended |
| Host Insights | View | Recommended to access the IOC Rules page to block indicators or evaluate hash exceptions. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.