Privileged IT Admin - Administrator Guide - Cortex XDR - Cortex

Privileged IT Admin - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-12-02

Category

Administrator Guide

Abstract

Learn more about the Cortex XDR predefined user role called Privileged IT Admin.

The Privileged IT Admin role is used to manage and control endpoints and installations, configure Broker VMs, create profiles and policies, view alerts, and initiate Live Terminal.

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Action Center	—	—	✓	✓
				Isolate —
				Terminate Process —
				Quarantine —
				File Retrieval ✓
				File Search ✓
				Destroy Files ✓
				Allow List/Block List —
				Disable Response Actions —
				Remediation ✓
				Delete Quarantined files —
EDL	✓	N/A	—	—
Agent Scripts Library	—	—	✓	✓
				Run Standard Script ✓
				Run High-Risk Script ✓
				Script Configurations ✓
Live Terminal	—	N/A	✓	—
Automation Rules	✓	—	—	—

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Network Configuration	—	—	✓	—
Compliance	—	✓	N/A	—
Asset Inventory	—	✓	—	—
Asset Roles Configuration	✓	—	—	—

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Endpoint Administrations	—	—	✓	✓
				Endpoint Management ✓
				Retrieve Endpoint Data ✓
				Endpoint Scan ✓
				Change Managing Server ✓
				Pause Protection ✓
				Endpoint Token Management ✓
Endpoint Groups	—	—	✓	—
Endpoint Prevention Policies	—	✓	—	—
Global Exceptions	—	—	✓	—
Endpoint Profiles	—	✓	—	—
Endpoint Extension Policies	—	—	✓	—
Endpoint Installations	—	—	✓	—
Host Firewall	—	—	✓	—
Device Control	—	—	✓	✓
				Device Control Rules ✓
				Device Control Exceptions ✓