topic Re: Permission settings under Rules (BIOC, IOC and Correlations) in Cortex XDR Discussions

Permission settings under Rules (BIOC, IOC and Correlations)

tmeksik — Tue, 05 Aug 2025 22:12:36 GMT

Hi team

Is there a way to configure a role that allows access to just BIOC, IOC or Correlations - without always having to bundle them all together?

Thanks!

Re: Permission settings under Rules (BIOC, IOC and Correlations)

eluis — Wed, 06 Aug 2025 11:47:46 GMT

Hi Tmeksik

If you are assigned a role that enables Investigation → Rules privileges, you can view all user-defined and preconfigured rules for behavioral indicators of compromise (BIOCs).

Please have a look at :

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/BIOC-rule-details?contentId=3~zi5lAm6jzLWa52L5314A

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: Permission settings under Rules (BIOC, IOC and Correlations)

tmeksik — Wed, 06 Aug 2025 23:19:23 GMT

Sorry for not making it clearer...

I wonder if we can assign a role allowing granular access under Detection Rules. For e.g. a role that allows access to just IOC but not BIOC and Correlations.