topic Re: SBAC for DLP add-on in Cortex XDR Discussions

SBAC for DLP add-on

SeanDeHarris — Tue, 18 Aug 2026 09:14:49 GMT

Hello All,

Would SBAC also works for DLP (add-on) module events?

We wou ld enable SBAC for those Endpoints with DLP enable by department. Then allow each department head as the Data Security Reviewer to view their own DLP events.

Possible to do so?

Thanks,

SDH

Re: SBAC for DLP add-on

natasha052gandhi — Wed, 19 Aug 2026 07:21:54 GMT

Hello,

Yes, this should be possible, but it depends on how DLP events are mapped with SBAC attributes.

If the DLP events include the required details , you should be able to configure SBAC so each department head can review only their own department’s DLP events.

Re: SBAC for DLP add-on

susekar — Wed, 19 Aug 2026 13:34:13 GMT

Hello @SeanDeHarris ,

Greetings for the day.

Yes, Scope-Based Access Control (SBAC) works for Endpoint DLP (add-on) module events, but its enforcement varies significantly depending on which part of the console the department head is viewing.

While SBAC can successfully restrict visibility for DLP-related incidents and alerts, it currently has a major limitation regarding high-level dashboards like the Data Security Command Center.

1. Visibility of DLP Events

Endpoint DLP events are assigned to the Data Security domain.SBAC is supported in Incidents and Alerts.
Assign department heads an SBAC scope containing their Endpoint Groups/Tags and the Data Security domain.Incidents, Alerts, and Data Security Issues will show only events from endpoints within their assigned scope.

2. Dashboard Limitations

Data Security Command Center and its OOTB widgets do not currently respect SBAC.They display tenant-wide aggregate data.To prevent organization-wide visibility, avoid granting access to global Command Center dashboards.
Use custom dashboards with SBAC-compatible widgets instead.

3. Required Role Configuration

Alerts & Incidents: View
Data Security: Required permissions
Do not assign Account Administrator or Instance Administrator roles, as they bypass SBAC.

Implementation Steps:

Create Endpoint Groups by department.
Create the Data Security Reviewer role with View access to Incidents, Alerts, and Data Security.
Assign each department head the appropriate Endpoint Group and Data Security scope.
Enable SBAC under Settings > Configurations > General > Server Settings > Scoped Server Access.
For Cortex XDR 4.2+, Asset-led Access Control can also be used for supported dashboard widgets.

For more explanations/configuration assistance needed on this,I would request you to reach your Accounts team on this.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: SBAC for DLP add-on

SeanDeHarris — Thu, 20 Aug 2026 02:02:56 GMT

Thank you so much, this is very useful.
I wish this info would be included in the Cortex doc in the near future.