topic Restrict visibility of specific incident types based on user roles in Cortex XSOAR Discussions

Restrict visibility of specific incident types based on user roles

M.IbrahimHabibullah — Tue, 17 Sep 2024 12:43:59 GMT

Hello Everyone,

We're currently focused on improving our access control model to limit the visibility of certain incident types based on user roles. Currently, this is done manually through the system command:

```
/set_incident role = <role name>
```

This command is executed at each incident level and isn't available for execution within playbooks. We are investigating how to integrate this command into a playbook to automate role-based logic.

What is the best way to implement this, or are there alternative approaches we should consider? We're seeking input from the community on this.

Re: Restrict visibility of specific incident types based on user roles

gyldz — Tue, 08 Oct 2024 07:54:47 GMT

Hi @M.IbrahimHabibullah ,

You can use setIncident to restrict the incidents to be reachable by specific roles. Please see the screenshot below. The users only having Administrator role will have access to the incident.

I hope this answers your question.

Re: Restrict visibility of specific incident types based on user roles

JBoehm — Thu, 20 Mar 2025 10:28:43 GMT

Little late to the party....
Hi @gyldz
Do you know if this is also working with indicators?