> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/managed-services-permissions.md).

# Managed Services permissions

Controls access to the **Managed Services** page for the Unit 42 Managed Threat Hunting (MTH) and Managed Detection & Response (MDR).

{% hint style="info" %}

### Notice

Requires a Managed Threat Hunting or Managed Detection and Response license. The tenant must be paired as a managed service tenant.
{% endhint %}

**Threads**

Threads are a collaborative communication record between a managed service provider (Unit 42 Managed Threat Hunting or Managed Detection & Response) and your tenant. Each thread represents an operational report delivered by the provider to you, along with all associated collaboration artifacts.

The Threads permission controls whether a user can access the **Managed Services** page, where all threads are listed, and whether they can perform actions on those threads (update status, assign users, add/edit/delete comments, attach files).

| Permission | Description                                                                                                                                                     | Roles Example                                                                                                                                                                                                                                                                                                                                                                                              |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to the **Managed Services** page.                                                                                                                     | None specified as a default, but applicable for roles that do not interact with managed service findings                                                                                                                                                                                                                                                                                                   |
| View       | Grants read-only access to the **Managed Services** page, including viewing threat reports, comments, report status, and assigned users.                        | <ul><li>SOC Tier-1 Analyst: Needs visibility into managed service threat reports to understand the threat landscape and triage related issues, but should not modify the thread status or assignments.</li><li>Security Engineer: Needs awareness of managed service findings for tuning detections and policies, but typically does not need to collaborate directly on threads.</li></ul>                |
| View/Edit  | Grants the ability to perform write operations: update thread status, assign/reassign users to threads, add/edit/delete comments, and attach files to comments. | <ul><li>SOC Tier-2 and 3 Analysts: Actively work on cases related to managed service reports. Needs to update thread status, add comments to collaborate with Unit 42/MDR analysts, and assign threads.</li><li>Threat Hunters: Primary consumer and collaborator on managed service threat reports. Must be able to update status, comment, and assign threads as part of the hunting workflow.</li></ul> |

**Required and recommended permissions**

Managed service reports frequently reference complex threat indicators, forensic artifacts, and underlying endpoint data. To effectively investigate and respond to a Thread, analysts require deep visibility into these corresponding platform modules. Consider adding the following permissions:

| Permission                    | Permission Level  | Reason                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ----------------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues                | View or View/Edit | <ul><li>View: Required to view cases linked to threads.</li><li>View/Edit: Strongly recommended to view and act on cases associated with threads for deeper analysis.</li></ul>                                                                                                                                                                                                                                                                                                                                                                           |
| Query Search                  | View or View/Edit | <ul><li>View: Required. Threads often reference data that requires investigation queries to analyze. Without query access, users cannot investigate the indicators, artifacts, or events referenced in the managed service reports.</li><li>View/Edit: Strongly recommended. Allows users to create and execute XQL queries to investigate threat indicators and artifacts referenced in managed service reports. Without this, the investigation is limited to pre-built views.</li></ul>                                                                |
| Forensics & Host Insights     | View or View/Edit | <ul><li>View: Strongly recommended: Managed service reports frequently reference forensic artifacts (file hashes, registry keys, network connections). Forensics view access allows users to examine endpoint timeline data and forensic evidence related to thread findings.</li><li>View/Edit: Recommended. Allows users to initiate forensic data collection (endpoint timeline, event log search) to gather additional evidence related to managed service findings. Useful for users who actively investigate threats reported in threads.</li></ul> |
| Dashboard                     | Enabled           | Managed service reports frequently reference forensic artifacts (file hashes, registry keys, network connections). Forensics view access allows users to examine endpoint timeline data and forensic evidence related to thread findings.                                                                                                                                                                                                                                                                                                                 |
| Detection Rules               | View              | Recommended for detection engineering and recommended for policy management and managing exceptions.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Threat Intel & Exclusion List | View or View/Edit | <ul><li>View: Recommended. Allows users to look up indicators of compromise (IOCs) referenced in managed service reports against the threat intelligence database. Useful for correlating thread findings with known threats.</li><li>View/Edit: Recommended. Enables users to add IOCs from managed service reports to the threat intelligence feed for automated detection and blocking.</li></ul>                                                                                                                                                      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/managed-services-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.