Help permissions - Administrator Guide - Cortex XSIAM - Cortex

Help permissions - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

The tenant must have an active support contract, and the user must have CSP portal access.

Permission	Description	Roles Example
None	The user can't submit support cases.
View/Edit	Enables users to submit support tickets directly from within Cortex XSIAM. This includes: Creating new support cases with Palo Alto Networks support. Attaching files and recordings to support tickets. Generating Technical Support Files (TSF) from endpoints. Recording browser sessions for troubleshooting.	All roles should be able to submit support cases.

Consider adding the following permissions:

Permission	Permission Level	Reason
Retrieve Endpoint Data	Checked	Enables TSF (Technical Support File) generation from endpoints directly within the support case wizard. Without this, users cannot attach endpoint diagnostic data to tickets, significantly reducing support effectiveness for endpoint-related issues. Strongly recommended.
Agent Administrations	View/Edit	Strongly recommended to view and select endpoints in the support case form. Without this, the endpoint selection dropdown is disabled. Users cannot pick a specific endpoint to associate with their ticket.
Agents (Cortex Agentic Assistant)	View/Edit	Enables agent-related permissions within the support case form. When present, it allows the user to include the agent context in support tickets. Recommended.
Cases & Issues	View	Recommended to enable users to reference and attach issue/case context when submitting support cases about detection issues.