Action Center permissions - Configure Action Center permissions, such as Isolate, quarantine, and terminate process. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

None

No access to the Action Center, and response action buttons are hidden.

SOC Tier-1 Analysts: View action history, isolation status, and quarantine lists, but cannot execute any actions.

View

Read-only access. You can see the action history and results, but cannot initiate any actions. All action buttons are hidden.

IT Admin: Response actions (isolate, terminate process, quarantine, file retrieval, file search, destroy files) are security response functions. Granting IT Admins access to these actions creates significant risk — they could isolate endpoints or destroy files.

View/Edit

Full control to initiate, retry, or cancel actions. This is a high-privilege permission that enables the Response in Endpoint Detection and Response (EDR). Unchecked actions remain view only.

When Action Center is set to View/Edit, the following action checkboxes become available. Each checkbox controls whether the user can execute that specific action type.

SOC Tier 2 and 3 Analysts, Threat Hunters, and Security Engineers have full access with granular controls.

Isolate

Isolates an endpoint from the network while maintaining communication with the Cortex XSIAM tenant.

All Responders/Admins. The SOC Tier-1 Analyst should escalate isolation decisions to Tier 2, but can monitor isolation status.

Terminate Process

Terminates running processes on endpoints. Can terminate individual processes by process ID or entire causality chains (all processes from a malicious parent). This stops active malicious activity without requiring full endpoint isolation.

The Causality view is available from the Cases or Issues pages, or from the Query Results (Investigation & Response) → Query Builder → Build an XQL Query)after running a query on the related data. From both of these places, you can pivot (right-click) to the causality chain view.

All Responders/Admins. The SOC Tier-1 Analyst should escalate process termination to Tier 2, but can view termination history.

Quarantine

Moves malicious or suspicious files to a secure quarantine folder on the endpoint, preventing execution while preserving the file for analysis. Quarantined files can be restored if determined to be false positives.

All Responders/Admins. SOC Tier-1 Analysts and Threat Hunters need to hand off to SOC Tier 2 and 3 Analysts for containment.

File Retrieval

Retrieves files from endpoints for forensic analysis. Files are uploaded to Cortex XSIAM where they can be downloaded for examination, malware analysis, or evidence preservation.

All Responders/Admins. SOC Tier-1 and 2 Analysts and Threat Hunters need to hand off to SOC Tier 3 Analysts or the Forensics Team for containment.

File Search

Searches for files across all managed endpoints by hash (SHA256, MD5), file path, or file name patterns. Used to determine file prevalence, locate IOCs, and identify affected endpoints.

All Responders/Admins. The SOC Tier-1 Analyst should escalate to the SOC Tier 2 Analyst.

Destroy Files

High risk. Permanently and irreversibly deletes files from endpoints. This is a destructive action that cannot be undone. Used to remove persistent malware or malicious files that cannot be quarantined.

SOC Tier-3 Analysts and Security Admins. This is a high-risk action that permanently deletes files and cannot be reversed.

Allow List/Block List

Exempt or block files matching specified hashes across the environment.

SOC Tier-3 Analysts, Threat Hunters, Security Engineers, and Security Admins who manage hash-based prevention policies.

Disable Response Actions

High risk. Temporarily disables or pauses endpoint protection and response capabilities. This weakens endpoint security and should be used only for troubleshooting or specific operational requirements.

You can view disabled response actions by going to Inventory → Endpoints → All Endpoints. If you have View/Edit permissions, pivot (right-click) an endpoint that isn't an iOS endpoint, and select Endpoint Control → Disable Capabilities.

Security Admins only. Disabling response actions reduces security posture and should require proper change management approval.

Remediation

Execute automated actions to reverse malicious system changes (registry, files, processes).

All Responders/Admins. The SOC Tier 1 Analyst should escalate to Tier 2 Analysts.

Delete Quarantine Files

High risk. Permanently deletes files from the quarantine folder on endpoints. Unlike restoring quarantined files, this action removes the files entirely and cannot be undone.