Privileged Responder - Administrator Guide - Cortex XDR - Cortex

Privileged Responder - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-12-02

Category

Administrator Guide

Abstract

Learn more about the Cortex XDR predefined user role called Privileged Responder.

The Privileged Responder role is used toView and triage alerts and incidents, access all response capabilities, and configure rules, policies, and profiles.

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Action Center	—	—	✓	✓
				Isolate ✓
				Terminate Process ✓
				Quarantine ✓
				File Retrieval ✓
				File Search ✓
				Destroy Files ✓
				Allow List/Block List ✓
				Disable Response Actions —
				Remediation ✓
				Delete Quarantined files —
EDL	—	N/A	✓	—
Agent Scripts Library	—	—	✓	✓
				Run Standard Script ✓
				Run High-Risk Script ✓
				Script Configurations ✓
Live Terminal	—	N/A	✓	—
Automation Rules	✓	—	—	—

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Network Configuration	—	—	✓	—
Compliance	—	✓	N/A	—
Asset Inventory	—	✓	—	—
Asset Roles Configuration	✓	—	—	—

Components	Permissions			Additional Action Permissions
	None	View	View/Edit	Edit/None
Endpoint Administrations	—	—	✓	✓
				Endpoint Management —
				Retrieve Endpoint Data ✓
				Endpoint Scan ✓
				Change Managing Server —
				Pause Protection —
				Endpoint Token Management ✓
Endpoint Groups	—	✓	—	—
Endpoint Prevention Policies	—	✓	—	—
Global Exceptions	✓	—	—	—
Endpoint Profiles	—	✓	—	—
Endpoint Extension Policies	—	—	✓	—
Endpoint Installations	✓	—	—	—
Host Firewall	—	—	✓	—
Device Control	—	—	✓	✓
				Device Control Rules ✓
				Device Control Exceptions ✓