Abstract
Learn more about the Cortex XDR predefined user role called Responder.
Adds response actions to the Investigator base. Can view and triage alerts, and access all response capabilities (isolate, terminate, quarantine), but no Live Terminal, rule editing, or configuration access.
Tip
Assign to SOC Tier-2 analysts who need to take immediate containment actions (isolate, terminate, quarantine) when responding to confirmed threats, plus the ability to edit detection rules and manage threat intel.
To quickly see exactly which pages and actions a role allows, click on the role name, which opens a read-only view of all checked permissions. For more information about the permissions, see Role permissions by components.