Cortex XDR 5.xCortex XDR 3.x

Scope-Based Access Control (SBAC) changes and enhancements

Once your tenant is upgraded to version 5, the Scope-Based Access Control (SBAC) feature includes the following changes:

You can now apply these scoping definitions to existing or new user groups, users, and API keys using the following scoping areas in the Scope tab:
- Assets (New)
- Case and Issues (Existed previously, updated user experience)
- Endpoints (Existed previously, updated user experience)
A new, descriptive user interface provides intuitive workflows for defining and managing granular scoping.
Previously, SBAC granular scoping could only be configured when the SBAC setting was enabled. Now, even if the SBAC setting (renamed to Enable Scope-Based Access Control) is disabled, administrators can configure granular scoping before enabling the feature.
Previously, newly created user groups, users, and API keys had default access to all cases, issues, and endpoints. Now, newly created user groups, users, and API keys do not have default access to assets, cases, issues, and endpoints.
Previously, when using both an endpoint and a domain (now referred to as Endpoints and Cases and Issues scoping areas), access to Issues and Cases was granted when at least one of the scoping areas was matched. Now, access is provided when both scoping areas match.
Previously, only users with no Endpoint scoping could access cases and issues that did not reference a specific endpoint. Now, any user can be configured to have access to these cases and issues; yet, this is disabled by default. To grant this access, you must manually enable the setting: Allow access to cases and issues that are not referencing known assets or endpoints under the Cases and Issues scoping area.
When users with Endpoints scoping also belong to a User Group with no Endpoints scoping, after upgrading, these users will have access to ALL endpoints, as the User Group will have an All Endpoints scoping definition. If you encounter this scenario, you will need to perform any of the following, depending on the Endpoints scoping defined for users in the User Group:
- Add common Endpoints scoping to the User Group by selecting Endpoint Groups or Endpoint Tags.
- For the User Group, change the Endpoints scope to No Endpoints.
- Separate the users from the User Group and grant the users Endpoints scoping as applicable.
Attack Surface Management (ASM) related issues are scoped based on Asset Groups and Posture domain. This aligns with the migration of ASM alerts to the posture domain and the integration of ASM inventory into the unified asset inventory.