Application Security - Scans permissions - Configure Application Security Scans (Periodic, PR, and CI/CD) permission for Application Security. - Administrator Guide - Cortex XSIAM - Cortex

Application Security - Scans permissions - Configure Application Security Scans (Periodic, PR, and CI/CD) permission for Application Security. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-16

Notice

Requires the Application Security add-on, in addition to a foundational Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

Periodic

Branch Periodic Scans are scheduled, automated scans of repository branches. They run on a configurable schedule to continuously monitor the security posture of your codebase. Results show findings per branch, including IaC misconfigurations, vulnerabilities, secrets, and other issue types. To access Branch Periodic scans, go to Modules → Application Security → Scans → Branch Periodic Scans.

For more information, see Branch periodic scans.

Permission	Description	Roles Example
None	No access to Periodic Scans.	SOC Tier-1 and 2 Analysts: Scan results are not typically needed for case investigation at this tier.
View	Read-only access to periodic scan results. Users can view scan history, filter results, and view scan details. They cannot configure scan schedules, trigger manual scans, or modify scan configurations.	SOC Tier-3 Analyst: May need to verify scan coverage and results during advanced investigations. Threat Hunter: Reviews scan coverage to identify gaps in security monitoring.
View/Edit	Full access to configure and manage periodic scans. Includes all View capabilities plus: configure scan schedules, trigger manual scans, modify scan configurations, enable/disable scans, and configure scan scope.	Security Engineer: Configures scan schedules, triggers manual scans, and manages scan scope.

PR Scans

Pull Request Scans are event-driven scans triggered on PR creation or update. They provide inline security feedback to developers during the code review process, enabling shift-left security. Results are tied to specific pull requests and show new findings introduced by the PR. To access PR scans, go to Modules → Application Security → Scans → Pull Request Scans.

For more information, see Pull Request scans.

Permission	Description	Roles Example
None	No access to PR scans.	SOC Tier-1 and 2 Analysts: PR-level scan data is rarely needed for case investigation
View	Read-only access to PR scan results. Users can view PR scan history, filter results, and view scan details. They cannot configure PR scan settings or modify scan behavior.	SOC Tier-3 Analyst: May need to trace a security issue back to a specific PR during forensic analysis. Threat Hunter: May review PR scan data to understand how vulnerabilities were introduced.
View/Edit	Full access to configure and manage PR scans. Includes all View capabilities plus: configure PR scan triggers, modify scan settings, and manage PR scan behavior.	Security Engineer: Configures PR scan triggers and manages shift-left security enforcement.

CI/CD Scans

CI/CD Scans are scans integrated into CI/CD pipelines that run during pipeline execution. They provide security gates within the build and deployment process, enabling automated security checks before code reaches production. Results are tied to specific pipeline runs. To access CI/CD scans, go to Modules → Application Security → Scans → CI Scans.

For more information, see CI scans.

Permission	Description	Roles Example
None	No access to CI/CD Scans.	SOC Tier-1 and 2 Analysts: CI/CD scan data is rarely needed for case investigation at this tier
View	Read-only access to CI/CD scan results. Users can view CI/CD scan history, filter results, and view scan details. They cannot configure CI/CD scan settings or modify pipeline integrations.	SOC Tier-3 Analyst: May need to review pipeline scan results during supply chain attack investigations. Threat Hunter: Reviews CI/CD scan data to identify supply chain risks and pipeline vulnerabilities.
View/Edit	Full access to configure and manage CI/CD scans. Includes all View capabilities plus: configure CI/CD scan settings, modify pipeline integrations, and manage scan behavior.	Security Engineer: Configures CI/CD scan settings and manages pipeline security integrations.

Consider adding the following permissions:

Permission	Permission Level	Reason
Data Sources	View or View/Edit	CI/CD View: Strongly recommended for all scans. View connected repositories, CI/CD systems, and pipeline configurations. View/Edit: Strongly recommended. Configure CI/CD pipeline connections.
Integrations	View	Strongly recommended for CI/CD system integration status, and for PR Scans to view VCS webhook and PR integration status. Recommended for Periodic scans to view VCS integration status for scan connectivity.