Permission settings under Rules (BIOC, IOC and Correlations)

[tmeksik]

Hi team

Is there a way to configure a role that allows access to just BIOC, IOC or Correlations - without always having to bundle them all together?

Thanks!

[eluis]

Hi Tmeksik

If you are assigned a role that enables Investigation → Rules privileges, you can view all user-defined and preconfigured rules for behavioral indicators of compromise (BIOCs).

Please have a look at :

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/BIOC-rule-details...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

[tmeksik]

Sorry for not making it clearer...

I wonder if we can assign a role allowing granular access under Detection Rules. For e.g. a role that allows access to just IOC but not BIOC and Correlations.