> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md). # Roles in Cortex XSOAR A role is a set of permissions that determine which actions and resources users within that role are granted access in Cortex XSOAR. Users are assigned to at least one role, depending on their required level of access. You can add as many roles as you require, by clicking **New**. To create a new role, see [define a role](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md). Follow the same steps when editing a role. When defining a new role, you can add permissions, SAML and AD Roles, define shift periods and so on. Cortex XSOAR has the following assigned roles: | Role | Default Permissions | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Administrator |

Read/Write permissions for all components and access to all pages.

Default Administrators have the same permissions as administrators with a few additional permissions such as view audit log incidents. Default administrators are usually used for troubleshooting.

| | Analyst | Mix of Read and Read/Write permissions for all components and access to all pages. | | Read-Only | Read permissions for all components and access to all pages. | **Permissions** You can assign the following permissions to various components in Cortex XSOAR: | Permission | Description | | ---------- | ---------------------------------------------- | | None | No access to the specified component. | | Read | Can view but not edit the specified component. | | Read/Write | Can view and edit the specified component. | **Permission Levels** You can set permission levels for each component, such as incidents, indicators, jobs, scripts, etc. For more information, see [Role-based Permission Levels](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md). If you want to manage [shift](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/managing-shifts.md) periods for users, including who is on call and to whom to assign, you can [define a role](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md) for a specific shift period and then assign that shift to a user. **Default Administrator** Default administrators are usually used for troubleshooting, they are not counted as license users, cannot be deleted, and are also tenant administrators. The default administrator can view all incidents (including those that are marked as restricted) and view modifications to restricted incidents in the Audit Trail. To prevent the default administrator from viewing these restricted incidents, set the **`incident.restrict.default.admin`** property to **`true`**. The following table describes the administrator and default administrator permissions: | Component | Permission | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Users and Roles | | | API Keys | | | Incidents |

(Default Administrator)

| | Integrations | (Default Administrator) Trigger the integration **fetch** command. | | Dashboards | | | Automation | Run all automations. | | Playbooks | | | Multi-Tenant | View all tenant accounts. | | File Entries | (Default Administrator) Delete file entries from the file system | You can [Set the User as Default Administrator](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/user-management/set-the-user-as-default-administrator.md) and [Change the Default Administrator to a SAML User](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.