Limit Access to Investigations using RBAC

Follow these steps to limit access to investigations using Role-based Access Control.

When you define access to an investigation according to Cortex XSOAR’s roles, only users with that role can view and access the investigation.

In the

Incident

page, select the incident you want to restrict access.

In the CLI, type

/incident_set roles=name of the role

To check that the role was assigned to the incident, click the

War Room

tab.

(Optional) For automations:

Use the

setIncident

command in a playbook.

Specify the roles that you want to have access to the incident investigation.

Document:Cortex XSOAR Administrator’s Guide