Reference: Permissions

org.get

View organization information

org.del

Delete organization

org.set_quota

Manage organization quotas

org.conf.get

View organization configuration

org.conf.set

Modify organization configuration

apikey.ctrl

Create, delete, and modify API keys

user.ctrl

Manage user accounts and permissions

billing.ctrl

Access and modify billing information

sensor.list

List all sensors in organization

sensor.get

View detailed sensor information

sensor.task

Send commands and tasks to sensors

sensor.del

Delete sensors

sensor.tag

Manage sensor tags and labels

ikey.list

List installation keys

ikey.set

Create new installation keys

ikey.del

Delete installation keys

dr.list

List general detection rules

dr.set

Create and modify general detection rules

dr.del

Delete general detection rules

dr.list.managed

List managed detection rules

dr.set.managed

Create and modify managed detection rules

dr.del.managed

Delete managed detection rules

dr.list.service

List service detection rules

dr.set.service

Create and modify service detection rules

dr.del.service

Delete service detection rules

fp.ctrl

Manage false positive suppressions

secret.get

Access secret values

secret.set

Create and modify secrets

secret.del

Delete secrets

secret.get.mtd

View secret metadata only

secret.set.mtd

Modify secret metadata only

lookup.get

Access lookup tables

lookup.set

Create and modify lookup tables

lookup.del

Delete lookup tables

lookup.get.mtd

View lookup metadata only

lookup.set.mtd

Modify lookup metadata only

model.get

Access behavioral models

model.set

Create and modify behavioral models

model.del

Delete behavioral models

model.get.mtd

View model metadata only

model.set.mtd

Modify model metadata only

query.get

Access saved queries

query.set

Create and modify saved queries

query.del

Delete saved queries

query.get.mtd

View query metadata only

query.set.mtd

Modify query metadata only

yara.get

Access YARA rules

yara.set

Create and modify YARA rules

yara.del

Delete YARA rules

yara.get.mtd

View YARA rule metadata only

yara.set.mtd

Modify YARA rule metadata only

ai_agent.get

Access AI agent configurations

ai_agent.set

Create and modify AI agents

ai_agent.del

Delete AI agents

ai_agent.get.mtd

View AI agent metadata only

ai_agent.set.mtd

Modify AI agent metadata only

cloudsensor.get

Access cloud sensor configurations

cloudsensor.set

Create and modify cloud sensor configurations

cloudsensor.del

Delete cloud sensor configurations

cloudsensor.get.mtd

View cloud sensor metadata only

cloudsensor.set.mtd

Modify cloud sensor metadata only

playbook.get

Access playbooks

playbook.set

Create and modify playbooks

playbook.del

Delete playbooks

playbook.get.mtd

View playbook metadata only

playbook.set.mtd

Modify playbook metadata only

externaladapter.get

Access external adapter configurations

externaladapter.set

Create and modify external adapters

externaladapter.del

Delete external adapter configurations

externaladapter.get.mtd

View external adapter metadata only

externaladapter.set.mtd

Modify external adapter metadata only

ext.request

Request extension actions

ext.conf.get

View extension configurations

ext.conf.set

Modify extension configurations

ext.conf.del

Delete extension configurations

ext.conf.get.mtd

View extension metadata only

ext.conf.set.mtd

Modify extension metadata only

ext.sub

Subscribe to extension services

ext.sub.mtd

Manage extension subscription metadata

replicant.get

View replicant service status

replicant.ctrl

Control replicant services

insight.list

List available insights

insight.ctrl

Control insight generation

insight.del

Delete insights

insight.evt.get

Access detailed event data

insight.evt.get.simple

Access simplified event data

insight.det.get

Access detection details

insight.stat

Access insight statistics

audit.get

Access audit logs and error messages

audit.set

Create audit logs entries

job.get

View job status and results

job.ctrl

Create and schedule jobs

output.list

List output configurations

output.set

Create and modify output configurations

output.del

Delete output configurations

payload.ctrl

Manage sensor payloads

module.update

Update sensor modules

ingestkey.ctrl

Manage data ingestion keys