Manage user access - Manage access permissions for Cortex XSIAM users. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-16
Category
Administrator Guide
Abstract

Manage access permissions for Cortex XSIAM users.

Prerequisite

Managing users, roles, scopes, user groups, authentication settings in Cortex XSIAM Access Management requires View/Edit RBAC permissions for Access Management (under Configurations). Account Admin and Instance Administrator roles are granted this permission by default. For more information, see Predefined user roles in Set up users, groups, and roles.

Review the following topics:

Manage access permissions for Cortex XSIAM users.

Edit user permissions

Update a user's role and scope, add a user to a user group, and view permissions based on the role, scope, and user groups assigned to the user.

You can configure granular scoping for Scope-Based Access Control (SBAC) by granting access only to the relevant data that the user requires for their designated role. Administrators apply scopes to limit the data and content that users can be granted access to in Cortex XSIAM, which are divided into different scoping areas. The scoping areas include Assets, Cases and Issues, Endpoints, and Datasets Rows, which can be applied as relevant to the enforcement area, entity, or dataset. For more information, see Manage user scope.

Note

You can only reduce the permissions of an Account Admin user via Cortex Gateway.

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Edit User Permissions.

    Tip

    To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

  3. In the Role tab, under Role, select the default or custom role.

  4. (Optional) Under User Groups, add the user to a group.

  5. (Optional) Under Show Accumulated Permissions:

    1. Do one of the following:

      • Select all to view the combined permissions for every role and user group assigned to the user.

      • Select a specific role assigned to the user to view the available permissions for that role.

    2. Under Components, expand each list to view the permissions to the various Cortex XSIAM components.

    3. Under Datasets, there are two possibilities for viewing a user's dataset access permissions:

      • When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed.

      • When dataset access management is disabled and users have access to all XQL datasets, the text No dataset has been selected is displayed.

    Note

    User permissions for components and datasets are based on the access permissions set in the user role. For more information on editing these user role permissions, see Manage user roles.

  6. (Optional) You can configure granular scoping:

    1. Click the Scope tab.

    2. Under Scope Definition, expand the scoping areas that you want to grant the user role access to in the tenant by clicking the chevron icon (>) beside the scoping area title, and make any changes required. The following table explains the options available to configure:

      Important

      Before configuring, ensure that you review Understand scoping in the Manage user scope section.

    Important

    By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensures that the users, user groups, and API Keys defined in Cortex XSIAM are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.

  7. Click Save.

Import multiple users

Use a CSV file to import users who belong to a Customer Support Portal account, and assign them roles that are defined in Cortex XSIAM. You can use the CSV template provided in Cortex XSIAM, or prepare a CSV file from scratch.

  1. Select Settings → Configurations → Access Management → Users.

  2. Click Import Multiple User Roles.

  3. Do one of the following:

    • To use the CSV template, click Download example file, and replace the example values with your values.

    • Prepare a CSV file from scratch. Make sure the file includes these columns:

      • User email: Email address of the user belonging to a Customer Support Portal account, for example, john.smith1@exampleCompany.com.

      • Role name: Name of the role that you want to assign to this user, for example, Privileged Responder. The role must already exist in Cortex XSIAM.

      • Is an account role: A boolean value that defines whether the user is designated with an Account Admin role in Cortex Gateway. Set the value to TRUE; otherwise, the value is set to FALSE (default).

  4. Locate the file and drag it to the dialog box.

  5. Click Import.

View user permissions

View all of the permissions currently assigned to a user.

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Edit User Permissions.

    Tip

    To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

  3. In the Role tab, under Show Accumulated Permissions, do one of the following:

    • Select all to view the combined permissions for every role and user group assigned to the user.

    • Select a specific role assigned to the user to view the available permissions for that role.

  4. Under Components, expand each list to view the permissions to the various Cortex XSIAM components.

  5. Under Datasets, there are two possibilities for viewing a user's dataset access permissions:

    • When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed.

    • When dataset access management is disabled and users have access to all XQL datasets, the text No dataset has been selected is displayed.

  6. To view the granular scoping configurations granted to the user role, click the Scope tab, and under Scope Definition, expand the scoping areas to view the settings by clicking the chevron icon (>) beside the scoping area title. The scoping areas include Assets, Cases and Issues, Endpoints, and Datasets Rows.

Hide user

There might be instances where you want to hide a user from the list of users, for example, a user that has a Customer Support Portal Super User role but isn't active on your Cortex XSIAM tenant. After you hide a user, they will no longer be displayed in the list of users when Show User Subset is selected on the Users page.

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Hide User.

Add user to a user group

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Edit User Permissions.

    Tip

    To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

  3. Under User Groups, add the user to a group.

  4. Click Save.

Deactivate user

You cannot deactivate a user who has an Account Admin role.

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Deactivate User.

  3. Click Deactivate.

Remove role assigned to user

You cannot remove a user who has an Account Admin role.

  1. Select Settings → Configurations → Access Management → Users.

  2. Right-click the relevant user, and select Remove User Role.

  3. Click Remove.