Role-based Permission Levels - Administrator Guide - EoL - 6.5 - Cortex XSOAR - Cortex - Security Operations

Account Management ( Multi-tenant)

Enables you to configure and manage the multi-tenant deployment, such as add/delete a host, change hosts, move to HA group, etc.

If you have Read or read/write permissions, you can select whether the role can sync content to tenant accounts.Sync Content to Tenant Accounts

Investigations

Sets the permission level generally for investigations or sets different permission levels for data and chats. You can also limit the role to exclude executing potential harmful actions when building your own integrations.

Incident table actions

Limits table actions in the Incidents page, such as delete, edit, close, and so on.

Exclusion List

Limits permissions when editing, creating, or deleting an indicator in an exclusion list.

Jobs

Limits permissions for managing jobs. Roles that have read permissions to content items, retain partial read access. If you do not want to retain partial read access, set the permission to none.

Scripts

Limits permissions for managing scripts. If the user has read/write permissions, you can enable users to create scripts that run as a Super User.

In the Script page, you can define which roles are permitted to run an automation, and according to which role the automation executes.

Playbooks

Limits permissions for creating, editing and deleting Playbooks.

You can also add, change, and remove roles from a playbook when clicking Settings in the Playbooks page.

Settings

You can set the permission level generally for all settings or split them according to the following:

Users: includes invitations and editing permissions.

Integrations: whether a user can add, edit or delete instances. Roles that have read permissions to content items, retain partial read access. If you do not want to retain partial read access, set the permission to none.

Credentials: whether a user can add, edit, or delete credentials.

Administration

Limits permissions for server configurations, editing layouts for indicators and incidents, integration permissions, audit trails and the password policy.

Propagation labels ( Multi-tenant)

Enables you to do the following:

Read: Enables you to select from existing propagation labels.Manage Content Overview

Read/Write: Enables you to create new and select from existing propagation labels

Marketplace

View Marketplace: Enables you to view the Marketplace.

Install Content Pack: install, upgrade, downgrade, and delete Content Pack content.

Contribute to Marketplace: Enables you to contribute a Content Pack in the Contributions tab or generally.

Page Access

Select the pages you want the user to have access to.

Default Dashboards

Select the default dashboards for each role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards.

Pre-set Role Queries

Select the Pre-set Query per Role for each of the available components.