Google Security Operations roles and permissions

This page lists the IAM roles and permissions for Google Security Operations. To search through all roles and permissions, see the role and permission index.

Google Security Operations roles

Role Permissions

(roles/chronicle.admin)

Full access to the Chronicle API services, including global settings.

chronicle.ais.*

  • chronicle.ais.createFeedback
  • chronicle.ais.translateUdmQuery
  • chronicle.ais.translateYlRule

chronicle.analyticValues.list

chronicle.analytics.list

chronicle.bigQueryAccess.provide

chronicle.bigQueryExport.*

  • chronicle.bigQueryExport.get
  • chronicle.bigQueryExport.provision
  • chronicle.bigQueryExport.update

chronicle.cases.countPriorities

chronicle.collectors.*

  • chronicle.collectors.create
  • chronicle.collectors.delete
  • chronicle.collectors.get
  • chronicle.collectors.list
  • chronicle.collectors.update

chronicle.conversations.*

  • chronicle.conversations.create
  • chronicle.conversations.delete
  • chronicle.conversations.get
  • chronicle.conversations.list
  • chronicle.conversations.update

chronicle.coverageDetails.*

  • chronicle.coverageDetails.get
  • chronicle.coverageDetails.list

chronicle.curatedRuleSetCategories.*

  • chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections
  • chronicle.curatedRuleSetCategories.get
  • chronicle.curatedRuleSetCategories.list

chronicle.curatedRuleSetDeployments.*

  • chronicle.curatedRuleSetDeployments.batchUpdate
  • chronicle.curatedRuleSetDeployments.get
  • chronicle.curatedRuleSetDeployments.list
  • chronicle.curatedRuleSetDeployments.update

chronicle.curatedRuleSets.*

  • chronicle.curatedRuleSets.countCuratedRuleSetDetections
  • chronicle.curatedRuleSets.get
  • chronicle.curatedRuleSets.list

chronicle.curatedRules.*

  • chronicle.curatedRules.get
  • chronicle.curatedRules.list

chronicle.dashboardCharts.*

  • chronicle.dashboardCharts.get
  • chronicle.dashboardCharts.list

chronicle.dashboardQueries.*

  • chronicle.dashboardQueries.execute
  • chronicle.dashboardQueries.get
  • chronicle.dashboardQueries.list

chronicle.dashboards.*

  • chronicle.dashboards.copy
  • chronicle.dashboards.create
  • chronicle.dashboards.delete
  • chronicle.dashboards.edit
  • chronicle.dashboards.get
  • chronicle.dashboards.list
  • chronicle.dashboards.schedule

chronicle.dataAccessLabels.*

  • chronicle.dataAccessLabels.create
  • chronicle.dataAccessLabels.delete
  • chronicle.dataAccessLabels.get
  • chronicle.dataAccessLabels.list
  • chronicle.dataAccessLabels.update

chronicle.dataAccessScopes.*

  • chronicle.dataAccessScopes.create
  • chronicle.dataAccessScopes.delete
  • chronicle.dataAccessScopes.get
  • chronicle.dataAccessScopes.list
  • chronicle.dataAccessScopes.permit
  • chronicle.dataAccessScopes.update

chronicle.dataExports.*

  • chronicle.dataExports.cancel
  • chronicle.dataExports.create
  • chronicle.dataExports.fetchLogTypesAvailableForExport
  • chronicle.dataExports.get

chronicle.dataTableOperationErrors.get

chronicle.dataTableRows.*

  • chronicle.dataTableRows.asyncBulkCreate
  • chronicle.dataTableRows.asyncBulkReplace
  • chronicle.dataTableRows.asyncBulkUpdate
  • chronicle.dataTableRows.bulkCreate
  • chronicle.dataTableRows.bulkGet
  • chronicle.dataTableRows.bulkReplace
  • chronicle.dataTableRows.bulkUpdate
  • chronicle.dataTableRows.create
  • chronicle.dataTableRows.delete
  • chronicle.dataTableRows.get
  • chronicle.dataTableRows.list
  • chronicle.dataTableRows.update

chronicle.dataTables.*

  • chronicle.dataTables.bulkCreateDataTableAsync
  • chronicle.dataTables.create
  • chronicle.dataTables.delete
  • chronicle.dataTables.get
  • chronicle.dataTables.list
  • chronicle.dataTables.update

chronicle.dataTaps.*

  • chronicle.dataTaps.create
  • chronicle.dataTaps.delete
  • chronicle.dataTaps.get
  • chronicle.dataTaps.list
  • chronicle.dataTaps.update

chronicle.enrichmentCombination.get

chronicle.enrichmentControls.*

  • chronicle.enrichmentControls.create
  • chronicle.enrichmentControls.delete
  • chronicle.enrichmentControls.disable
  • chronicle.enrichmentControls.get
  • chronicle.enrichmentControls.list

chronicle.entities.*

  • chronicle.entities.batchCreate
  • chronicle.entities.batchDelete
  • chronicle.entities.batchValidate
  • chronicle.entities.create
  • chronicle.entities.delete
  • chronicle.entities.find
  • chronicle.entities.findRelatedEntities
  • chronicle.entities.get
  • chronicle.entities.import
  • chronicle.entities.list
  • chronicle.entities.modifyEntityRiskScore
  • chronicle.entities.queryEntityRiskScoreModifications
  • chronicle.entities.searchEntities
  • chronicle.entities.summarize
  • chronicle.entities.summarizeFromQuery

chronicle.entityRiskScores.queryEntityRiskScores

chronicle.errorNotificationConfigs.*

  • chronicle.errorNotificationConfigs.create
  • chronicle.errorNotificationConfigs.delete
  • chronicle.errorNotificationConfigs.get
  • chronicle.errorNotificationConfigs.list
  • chronicle.errorNotificationConfigs.update

chronicle.events.*

  • chronicle.events.batchGet
  • chronicle.events.fetchEnrichedEvent
  • chronicle.events.findUdmFieldValues
  • chronicle.events.get
  • chronicle.events.import
  • chronicle.events.queryProductSourceStats
  • chronicle.events.searchRawLogs
  • chronicle.events.udmSearch
  • chronicle.events.validateQuery

chronicle.extensionValidationReports.*

  • chronicle.extensionValidationReports.get
  • chronicle.extensionValidationReports.list

chronicle.featuredContentNativeDashboards.*

  • chronicle.featuredContentNativeDashboards.get
  • chronicle.featuredContentNativeDashboards.install
  • chronicle.featuredContentNativeDashboards.list

chronicle.featuredContentRules.list

chronicle.featuredContentSearchQueries.*

  • chronicle.featuredContentSearchQueries.get
  • chronicle.featuredContentSearchQueries.install
  • chronicle.featuredContentSearchQueries.list

chronicle.feedPacks.*

  • chronicle.feedPacks.get
  • chronicle.feedPacks.list

chronicle.feedServiceAccounts.fetch

chronicle.feedSourceTypeSchemas.list

chronicle.feeds.*

  • chronicle.feeds.create
  • chronicle.feeds.delete
  • chronicle.feeds.disable
  • chronicle.feeds.enable
  • chronicle.feeds.generateSecret
  • chronicle.feeds.get
  • chronicle.feeds.list
  • chronicle.feeds.update

chronicle.findingsGraphs.*

  • chronicle.findingsGraphs.exploreNode
  • chronicle.findingsGraphs.initializeGraph

chronicle.findingsRefinementDeployments.*

  • chronicle.findingsRefinementDeployments.get
  • chronicle.findingsRefinementDeployments.list
  • chronicle.findingsRefinementDeployments.update

chronicle.findingsRefinements.*

  • chronicle.findingsRefinements.computeActivity
  • chronicle.findingsRefinements.computeAllActivities
  • chronicle.findingsRefinements.create
  • chronicle.findingsRefinements.get
  • chronicle.findingsRefinements.list
  • chronicle.findingsRefinements.test
  • chronicle.findingsRefinements.update

chronicle.formDynamicParameters.get

chronicle.forwarders.*

  • chronicle.forwarders.create
  • chronicle.forwarders.delete
  • chronicle.forwarders.generate
  • chronicle.forwarders.get
  • chronicle.forwarders.list
  • chronicle.forwarders.update

chronicle.globalDataAccessScopes.permit

chronicle.ingestionLogLabels.*

  • chronicle.ingestionLogLabels.get
  • chronicle.ingestionLogLabels.list

chronicle.ingestionLogNamespaces.*

  • chronicle.ingestionLogNamespaces.get
  • chronicle.ingestionLogNamespaces.list

chronicle.instances.generateCollectionAgentAuth

chronicle.instances.generateSoarAuthJwt

chronicle.instances.generateWorkspaceConnectionToken

chronicle.instances.get

chronicle.instances.graduatePocInstance

chronicle.instances.logTypeClassifier

chronicle.instances.report

chronicle.instances.update

chronicle.instances.verifyNonce

chronicle.investigationSteps.*

  • chronicle.investigationSteps.get
  • chronicle.investigationSteps.list

chronicle.investigations.*

  • chronicle.investigations.get
  • chronicle.investigations.list
  • chronicle.investigations.trigger

chronicle.iocAssociations.*

  • chronicle.iocAssociations.batchGet
  • chronicle.iocAssociations.fetchRelated
  • chronicle.iocAssociations.fetchRelatedIocAssociations
  • chronicle.iocAssociations.fetchRelatedThreatCollections
  • chronicle.iocAssociations.get

chronicle.iocMatches.*

  • chronicle.iocMatches.get
  • chronicle.iocMatches.list

chronicle.iocState.*

  • chronicle.iocState.get
  • chronicle.iocState.update

chronicle.iocs.*

  • chronicle.iocs.batchGet
  • chronicle.iocs.fetchRelated
  • chronicle.iocs.findFirstAndLastSeen
  • chronicle.iocs.findIocs
  • chronicle.iocs.get
  • chronicle.iocs.searchCuratedDetectionsForIoc

chronicle.legacies.*

  • chronicle.legacies.legacyBatchGetCases
  • chronicle.legacies.legacyBatchGetCollections
  • chronicle.legacies.legacyFetchAlertsView
  • chronicle.legacies.legacyFetchUdmSearchCsv
  • chronicle.legacies.legacyFetchUdmSearchView
  • chronicle.legacies.legacyFindAssetEvents
  • chronicle.legacies.legacyFindRawLogs
  • chronicle.legacies.legacyFindUdmEvents
  • chronicle.legacies.legacyGetAlert
  • chronicle.legacies.legacyGetCuratedRulesTrends
  • chronicle.legacies.legacyGetDetection
  • chronicle.legacies.legacyGetEventForDetection
  • chronicle.legacies.legacyGetRuleCounts
  • chronicle.legacies.legacyGetRulesTrends
  • chronicle.legacies.legacyRunTestRule
  • chronicle.legacies.legacySearchArtifactEvents
  • chronicle.legacies.legacySearchArtifactIoCDetails
  • chronicle.legacies.legacySearchAssetEvents
  • chronicle.legacies.legacySearchCuratedDetections
  • chronicle.legacies.legacySearchCustomerStats
  • chronicle.legacies.legacySearchDetections
  • chronicle.legacies.legacySearchDomainsRecentlyRegistered
  • chronicle.legacies.legacySearchDomainsTimingStats
  • chronicle.legacies.legacySearchEnterpriseWideAlerts
  • chronicle.legacies.legacySearchEnterpriseWideIoCs
  • chronicle.legacies.legacySearchFindings
  • chronicle.legacies.legacySearchIngestionStats
  • chronicle.legacies.legacySearchIoCInsights
  • chronicle.legacies.legacySearchRawLogs
  • chronicle.legacies.legacySearchRuleDetectionCountBuckets
  • chronicle.legacies.legacySearchRuleDetectionEvents
  • chronicle.legacies.legacySearchRuleResults
  • chronicle.legacies.legacySearchRulesAlerts
  • chronicle.legacies.legacySearchUserEvents
  • chronicle.legacies.legacyStreamDetectionAlerts
  • chronicle.legacies.legacyTestRuleStreaming
  • chronicle.legacies.legacyUpdateAlert

chronicle.logTypeSchemas.list

chronicle.logTypeSettings.*

  • chronicle.logTypeSettings.get
  • chronicle.logTypeSettings.list
  • chronicle.logTypeSettings.update

chronicle.logTypes.*

  • chronicle.logTypes.create
  • chronicle.logTypes.get
  • chronicle.logTypes.list
  • chronicle.logTypes.update

chronicle.logs.*

  • chronicle.logs.export
  • chronicle.logs.get
  • chronicle.logs.import
  • chronicle.logs.list

chronicle.messages.*

  • chronicle.messages.create
  • chronicle.messages.delete
  • chronicle.messages.get
  • chronicle.messages.list
  • chronicle.messages.update

chronicle.moduleSettings.get

chronicle.moduleSettingsProperties.*

  • chronicle.moduleSettingsProperties.get
  • chronicle.moduleSettingsProperties.testSettings
  • chronicle.moduleSettingsProperties.update

chronicle.multitenantDirectories.get

chronicle.nativeDashboards.*

  • chronicle.nativeDashboards.create
  • chronicle.nativeDashboards.delete
  • chronicle.nativeDashboards.duplicate
  • chronicle.nativeDashboards.get
  • chronicle.nativeDashboards.list
  • chronicle.nativeDashboards.update

chronicle.notebooks.*

  • chronicle.notebooks.get
  • chronicle.notebooks.list

chronicle.operations.*

  • chronicle.operations.cancel
  • chronicle.operations.delete
  • chronicle.operations.get
  • chronicle.operations.list
  • chronicle.operations.streamSearch
  • chronicle.operations.wait

chronicle.parserExtensions.*

  • chronicle.parserExtensions.activate
  • chronicle.parserExtensions.create
  • chronicle.parserExtensions.delete
  • chronicle.parserExtensions.generateKeyValueMappings
  • chronicle.parserExtensions.get
  • chronicle.parserExtensions.legacySubmitParserExtension
  • chronicle.parserExtensions.list
  • chronicle.parserExtensions.removeSyslog

chronicle.parsers.*

  • chronicle.parsers.activate
  • chronicle.parsers.activateReleaseCandidate
  • chronicle.parsers.copyPrebuiltParser
  • chronicle.parsers.create
  • chronicle.parsers.deactivate
  • chronicle.parsers.delete
  • chronicle.parsers.generateEventTypesSuggestions
  • chronicle.parsers.get
  • chronicle.parsers.list
  • chronicle.parsers.runParser

chronicle.parsingErrors.list

chronicle.preferenceSets.*

  • chronicle.preferenceSets.get
  • chronicle.preferenceSets.update

chronicle.referenceLists.*

  • chronicle.referenceLists.create
  • chronicle.referenceLists.get
  • chronicle.referenceLists.list
  • chronicle.referenceLists.update
  • chronicle.referenceLists.verifyReferenceList

chronicle.retrohunts.*

  • chronicle.retrohunts.create
  • chronicle.retrohunts.get
  • chronicle.retrohunts.list

chronicle.riskConfigs.*

  • chronicle.riskConfigs.get
  • chronicle.riskConfigs.update

chronicle.ruleDeployments.*

  • chronicle.ruleDeployments.get
  • chronicle.ruleDeployments.list
  • chronicle.ruleDeployments.update

chronicle.ruleExecutionErrors.list

chronicle.rules.*

  • chronicle.rules.create
  • chronicle.rules.delete
  • chronicle.rules.get
  • chronicle.rules.list
  • chronicle.rules.listRevisions
  • chronicle.rules.update
  • chronicle.rules.verifyRuleText

chronicle.searchQueries.*

  • chronicle.searchQueries.create
  • chronicle.searchQueries.delete
  • chronicle.searchQueries.get
  • chronicle.searchQueries.list
  • chronicle.searchQueries.update

chronicle.shareConfigs.*

  • chronicle.shareConfigs.get
  • chronicle.shareConfigs.update

chronicle.tenants.*

  • chronicle.tenants.create
  • chronicle.tenants.list

chronicle.threatCollectionFilterSet.get

chronicle.threatCollections.*

  • chronicle.threatCollections.fetchEntityMetadata
  • chronicle.threatCollections.fetchIocMatchMetadata
  • chronicle.threatCollections.fetchRelated
  • chronicle.threatCollections.fetchRuleMetadata
  • chronicle.threatCollections.get
  • chronicle.threatCollections.list

chronicle.validationErrors.list

chronicle.validationReports.get

chronicle.watchlists.*

  • chronicle.watchlists.create
  • chronicle.watchlists.delete
  • chronicle.watchlists.get
  • chronicle.watchlists.list
  • chronicle.watchlists.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.dataGovernor)

Grants elevated access to control the lifecycle of the Chronicle instance and its data.

chronicle.instances.delete

chronicle.instances.undelete

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.editor)

Modify Access to Chronicle API resources.

chronicle.ais.*

  • chronicle.ais.createFeedback
  • chronicle.ais.translateUdmQuery
  • chronicle.ais.translateYlRule

chronicle.analyticValues.list

chronicle.analytics.list

chronicle.bigQueryExport.get

chronicle.cases.countPriorities

chronicle.collectors.get

chronicle.collectors.list

chronicle.conversations.*

  • chronicle.conversations.create
  • chronicle.conversations.delete
  • chronicle.conversations.get
  • chronicle.conversations.list
  • chronicle.conversations.update

chronicle.curatedRuleSetCategories.*

  • chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections
  • chronicle.curatedRuleSetCategories.get
  • chronicle.curatedRuleSetCategories.list

chronicle.curatedRuleSetDeployments.*

  • chronicle.curatedRuleSetDeployments.batchUpdate
  • chronicle.curatedRuleSetDeployments.get
  • chronicle.curatedRuleSetDeployments.list
  • chronicle.curatedRuleSetDeployments.update

chronicle.curatedRuleSets.*

  • chronicle.curatedRuleSets.countCuratedRuleSetDetections
  • chronicle.curatedRuleSets.get
  • chronicle.curatedRuleSets.list

chronicle.curatedRules.*

  • chronicle.curatedRules.get
  • chronicle.curatedRules.list

chronicle.dashboardCharts.*

  • chronicle.dashboardCharts.get
  • chronicle.dashboardCharts.list

chronicle.dashboardQueries.*

  • chronicle.dashboardQueries.execute
  • chronicle.dashboardQueries.get
  • chronicle.dashboardQueries.list

chronicle.dashboards.*

  • chronicle.dashboards.copy
  • chronicle.dashboards.create
  • chronicle.dashboards.delete
  • chronicle.dashboards.edit
  • chronicle.dashboards.get
  • chronicle.dashboards.list
  • chronicle.dashboards.schedule

chronicle.dataAccessScopes.list

chronicle.dataExports.*

  • chronicle.dataExports.cancel
  • chronicle.dataExports.create
  • chronicle.dataExports.fetchLogTypesAvailableForExport
  • chronicle.dataExports.get

chronicle.dataTableOperationErrors.get

chronicle.dataTableRows.*

  • chronicle.dataTableRows.asyncBulkCreate
  • chronicle.dataTableRows.asyncBulkReplace
  • chronicle.dataTableRows.asyncBulkUpdate
  • chronicle.dataTableRows.bulkCreate
  • chronicle.dataTableRows.bulkGet
  • chronicle.dataTableRows.bulkReplace
  • chronicle.dataTableRows.bulkUpdate
  • chronicle.dataTableRows.create
  • chronicle.dataTableRows.delete
  • chronicle.dataTableRows.get
  • chronicle.dataTableRows.list
  • chronicle.dataTableRows.update

chronicle.dataTables.*

  • chronicle.dataTables.bulkCreateDataTableAsync
  • chronicle.dataTables.create
  • chronicle.dataTables.delete
  • chronicle.dataTables.get
  • chronicle.dataTables.list
  • chronicle.dataTables.update

chronicle.dataTaps.*

  • chronicle.dataTaps.create
  • chronicle.dataTaps.delete
  • chronicle.dataTaps.get
  • chronicle.dataTaps.list
  • chronicle.dataTaps.update

chronicle.enrichmentCombination.get

chronicle.enrichmentControls.create

chronicle.enrichmentControls.disable

chronicle.enrichmentControls.get

chronicle.enrichmentControls.list

chronicle.entities.*

  • chronicle.entities.batchCreate
  • chronicle.entities.batchDelete
  • chronicle.entities.batchValidate
  • chronicle.entities.create
  • chronicle.entities.delete
  • chronicle.entities.find
  • chronicle.entities.findRelatedEntities
  • chronicle.entities.get
  • chronicle.entities.import
  • chronicle.entities.list
  • chronicle.entities.modifyEntityRiskScore
  • chronicle.entities.queryEntityRiskScoreModifications
  • chronicle.entities.searchEntities
  • chronicle.entities.summarize
  • chronicle.entities.summarizeFromQuery

chronicle.entityRiskScores.queryEntityRiskScores

chronicle.errorNotificationConfigs.get

chronicle.errorNotificationConfigs.list

chronicle.events.*

  • chronicle.events.batchGet
  • chronicle.events.fetchEnrichedEvent
  • chronicle.events.findUdmFieldValues
  • chronicle.events.get
  • chronicle.events.import
  • chronicle.events.queryProductSourceStats
  • chronicle.events.searchRawLogs
  • chronicle.events.udmSearch
  • chronicle.events.validateQuery

chronicle.featuredContentNativeDashboards.*

  • chronicle.featuredContentNativeDashboards.get
  • chronicle.featuredContentNativeDashboards.install
  • chronicle.featuredContentNativeDashboards.list

chronicle.featuredContentRules.list

chronicle.featuredContentSearchQueries.*

  • chronicle.featuredContentSearchQueries.get
  • chronicle.featuredContentSearchQueries.install
  • chronicle.featuredContentSearchQueries.list

chronicle.feedPacks.*

  • chronicle.feedPacks.get
  • chronicle.feedPacks.list

chronicle.findingsGraphs.*

  • chronicle.findingsGraphs.exploreNode
  • chronicle.findingsGraphs.initializeGraph

chronicle.findingsRefinementDeployments.*

  • chronicle.findingsRefinementDeployments.get
  • chronicle.findingsRefinementDeployments.list
  • chronicle.findingsRefinementDeployments.update

chronicle.findingsRefinements.*

  • chronicle.findingsRefinements.computeActivity
  • chronicle.findingsRefinements.computeAllActivities
  • chronicle.findingsRefinements.create
  • chronicle.findingsRefinements.get
  • chronicle.findingsRefinements.list
  • chronicle.findingsRefinements.test
  • chronicle.findingsRefinements.update

chronicle.formDynamicParameters.get

chronicle.forwarders.generate

chronicle.forwarders.get

chronicle.forwarders.list

chronicle.globalDataAccessScopes.permit

chronicle.ingestionLogLabels.*

  • chronicle.ingestionLogLabels.get
  • chronicle.ingestionLogLabels.list

chronicle.ingestionLogNamespaces.*

  • chronicle.ingestionLogNamespaces.get
  • chronicle.ingestionLogNamespaces.list

chronicle.instances.generateCollectionAgentAuth

chronicle.instances.generateSoarAuthJwt

chronicle.instances.get

chronicle.instances.logTypeClassifier

chronicle.instances.report

chronicle.investigationSteps.*

  • chronicle.investigationSteps.get
  • chronicle.investigationSteps.list

chronicle.investigations.*

  • chronicle.investigations.get
  • chronicle.investigations.list
  • chronicle.investigations.trigger

chronicle.iocAssociations.*

  • chronicle.iocAssociations.batchGet
  • chronicle.iocAssociations.fetchRelated
  • chronicle.iocAssociations.fetchRelatedIocAssociations
  • chronicle.iocAssociations.fetchRelatedThreatCollections
  • chronicle.iocAssociations.get

chronicle.iocMatches.*

  • chronicle.iocMatches.get
  • chronicle.iocMatches.list

chronicle.iocState.*

  • chronicle.iocState.get
  • chronicle.iocState.update

chronicle.iocs.*

  • chronicle.iocs.batchGet
  • chronicle.iocs.fetchRelated
  • chronicle.iocs.findFirstAndLastSeen
  • chronicle.iocs.findIocs
  • chronicle.iocs.get
  • chronicle.iocs.searchCuratedDetectionsForIoc

chronicle.legacies.*

  • chronicle.legacies.legacyBatchGetCases
  • chronicle.legacies.legacyBatchGetCollections
  • chronicle.legacies.legacyFetchAlertsView
  • chronicle.legacies.legacyFetchUdmSearchCsv
  • chronicle.legacies.legacyFetchUdmSearchView
  • chronicle.legacies.legacyFindAssetEvents
  • chronicle.legacies.legacyFindRawLogs
  • chronicle.legacies.legacyFindUdmEvents
  • chronicle.legacies.legacyGetAlert
  • chronicle.legacies.legacyGetCuratedRulesTrends
  • chronicle.legacies.legacyGetDetection
  • chronicle.legacies.legacyGetEventForDetection
  • chronicle.legacies.legacyGetRuleCounts
  • chronicle.legacies.legacyGetRulesTrends
  • chronicle.legacies.legacyRunTestRule
  • chronicle.legacies.legacySearchArtifactEvents
  • chronicle.legacies.legacySearchArtifactIoCDetails
  • chronicle.legacies.legacySearchAssetEvents
  • chronicle.legacies.legacySearchCuratedDetections
  • chronicle.legacies.legacySearchCustomerStats
  • chronicle.legacies.legacySearchDetections
  • chronicle.legacies.legacySearchDomainsRecentlyRegistered
  • chronicle.legacies.legacySearchDomainsTimingStats
  • chronicle.legacies.legacySearchEnterpriseWideAlerts
  • chronicle.legacies.legacySearchEnterpriseWideIoCs
  • chronicle.legacies.legacySearchFindings
  • chronicle.legacies.legacySearchIngestionStats
  • chronicle.legacies.legacySearchIoCInsights
  • chronicle.legacies.legacySearchRawLogs
  • chronicle.legacies.legacySearchRuleDetectionCountBuckets
  • chronicle.legacies.legacySearchRuleDetectionEvents
  • chronicle.legacies.legacySearchRuleResults
  • chronicle.legacies.legacySearchRulesAlerts
  • chronicle.legacies.legacySearchUserEvents
  • chronicle.legacies.legacyStreamDetectionAlerts
  • chronicle.legacies.legacyTestRuleStreaming
  • chronicle.legacies.legacyUpdateAlert

chronicle.logTypeSchemas.list

chronicle.logs.*

  • chronicle.logs.export
  • chronicle.logs.get
  • chronicle.logs.import
  • chronicle.logs.list

chronicle.messages.*

  • chronicle.messages.create
  • chronicle.messages.delete
  • chronicle.messages.get
  • chronicle.messages.list
  • chronicle.messages.update

chronicle.multitenantDirectories.get

chronicle.nativeDashboards.*

  • chronicle.nativeDashboards.create
  • chronicle.nativeDashboards.delete
  • chronicle.nativeDashboards.duplicate
  • chronicle.nativeDashboards.get
  • chronicle.nativeDashboards.list
  • chronicle.nativeDashboards.update

chronicle.notebooks.*

  • chronicle.notebooks.get
  • chronicle.notebooks.list

chronicle.operations.*

  • chronicle.operations.cancel
  • chronicle.operations.delete
  • chronicle.operations.get
  • chronicle.operations.list
  • chronicle.operations.streamSearch
  • chronicle.operations.wait

chronicle.preferenceSets.*

  • chronicle.preferenceSets.get
  • chronicle.preferenceSets.update

chronicle.referenceLists.*

  • chronicle.referenceLists.create
  • chronicle.referenceLists.get
  • chronicle.referenceLists.list
  • chronicle.referenceLists.update
  • chronicle.referenceLists.verifyReferenceList

chronicle.retrohunts.*

  • chronicle.retrohunts.create
  • chronicle.retrohunts.get
  • chronicle.retrohunts.list

chronicle.riskConfigs.*

  • chronicle.riskConfigs.get
  • chronicle.riskConfigs.update

chronicle.ruleDeployments.*

  • chronicle.ruleDeployments.get
  • chronicle.ruleDeployments.list
  • chronicle.ruleDeployments.update

chronicle.ruleExecutionErrors.list

chronicle.rules.create

chronicle.rules.get

chronicle.rules.list

chronicle.rules.listRevisions

chronicle.rules.update

chronicle.rules.verifyRuleText

chronicle.searchQueries.*

  • chronicle.searchQueries.create
  • chronicle.searchQueries.delete
  • chronicle.searchQueries.get
  • chronicle.searchQueries.list
  • chronicle.searchQueries.update

chronicle.threatCollectionFilterSet.get

chronicle.threatCollections.*

  • chronicle.threatCollections.fetchEntityMetadata
  • chronicle.threatCollections.fetchIocMatchMetadata
  • chronicle.threatCollections.fetchRelated
  • chronicle.threatCollections.fetchRuleMetadata
  • chronicle.threatCollections.get
  • chronicle.threatCollections.list

chronicle.watchlists.*

  • chronicle.watchlists.create
  • chronicle.watchlists.delete
  • chronicle.watchlists.get
  • chronicle.watchlists.list
  • chronicle.watchlists.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.federationAdmin)

Full access to Chronicle Federation features.

chronicle.federationGroups.*

  • chronicle.federationGroups.create
  • chronicle.federationGroups.delete
  • chronicle.federationGroups.get
  • chronicle.federationGroups.list
  • chronicle.federationGroups.update

chronicle.instances.permitFederationAccess

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.federationViewer)

Readonly access to Chronicle Federation Features.

chronicle.federationGroups.get

chronicle.federationGroups.list

chronicle.instances.permitFederationAccess

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.globalDataAccess)

Grants global access to data i.e. all data can be accessed.

chronicle.globalDataAccessScopes.permit

(roles/chronicle.limitedViewer)

Grants read-only access to Chronicle API resources, excluding Rules and Retrohunts.

chronicle.analyticValues.list

chronicle.analytics.list

chronicle.cases.countPriorities

chronicle.conversations.get

chronicle.conversations.list

chronicle.dashboardCharts.*

  • chronicle.dashboardCharts.get
  • chronicle.dashboardCharts.list

chronicle.dashboardQueries.*

  • chronicle.dashboardQueries.execute
  • chronicle.dashboardQueries.get
  • chronicle.dashboardQueries.list

chronicle.dashboards.get

chronicle.dashboards.list

chronicle.dashboards.schedule

chronicle.dataAccessScopes.list

chronicle.enrichmentCombination.get

chronicle.enrichmentControls.get

chronicle.enrichmentControls.list

chronicle.entities.find

chronicle.entities.findRelatedEntities

chronicle.entities.get

chronicle.entities.queryEntityRiskScoreModifications

chronicle.entities.searchEntities

chronicle.entities.summarize

chronicle.entities.summarizeFromQuery

chronicle.entityRiskScores.queryEntityRiskScores

chronicle.errorNotificationConfigs.get

chronicle.errorNotificationConfigs.list

chronicle.events.batchGet

chronicle.events.fetchEnrichedEvent

chronicle.events.findUdmFieldValues

chronicle.events.get

chronicle.events.queryProductSourceStats

chronicle.events.searchRawLogs

chronicle.events.udmSearch

chronicle.events.validateQuery

chronicle.featuredContentNativeDashboards.get

chronicle.featuredContentNativeDashboards.list

chronicle.featuredContentSearchQueries.get

chronicle.featuredContentSearchQueries.list

chronicle.findingsGraphs.*

  • chronicle.findingsGraphs.exploreNode
  • chronicle.findingsGraphs.initializeGraph

chronicle.findingsRefinementDeployments.get

chronicle.findingsRefinementDeployments.list

chronicle.findingsRefinements.computeActivity

chronicle.findingsRefinements.computeAllActivities

chronicle.findingsRefinements.get

chronicle.findingsRefinements.list

chronicle.findingsRefinements.test

chronicle.globalDataAccessScopes.permit

chronicle.ingestionLogLabels.*

  • chronicle.ingestionLogLabels.get
  • chronicle.ingestionLogLabels.list

chronicle.ingestionLogNamespaces.*

  • chronicle.ingestionLogNamespaces.get
  • chronicle.ingestionLogNamespaces.list

chronicle.instances.get

chronicle.investigationSteps.*

  • chronicle.investigationSteps.get
  • chronicle.investigationSteps.list

chronicle.iocAssociations.*

  • chronicle.iocAssociations.batchGet
  • chronicle.iocAssociations.fetchRelated
  • chronicle.iocAssociations.fetchRelatedIocAssociations
  • chronicle.iocAssociations.fetchRelatedThreatCollections
  • chronicle.iocAssociations.get

chronicle.iocs.fetchRelated

chronicle.iocs.findIocs

chronicle.legacies.legacyBatchGetCases

chronicle.legacies.legacyBatchGetCollections

chronicle.legacies.legacyFetchAlertsView

chronicle.legacies.legacyFetchUdmSearchCsv

chronicle.legacies.legacyFetchUdmSearchView

chronicle.legacies.legacyFindAssetEvents

chronicle.legacies.legacyFindRawLogs

chronicle.legacies.legacyFindUdmEvents

chronicle.legacies.legacyGetAlert

chronicle.legacies.legacySearchArtifactEvents

chronicle.legacies.legacySearchArtifactIoCDetails

chronicle.legacies.legacySearchAssetEvents

chronicle.legacies.legacySearchCustomerStats

chronicle.legacies.legacySearchDomainsRecentlyRegistered

chronicle.legacies.legacySearchDomainsTimingStats

chronicle.legacies.legacySearchEnterpriseWideAlerts

chronicle.legacies.legacySearchEnterpriseWideIoCs

chronicle.legacies.legacySearchFindings

chronicle.legacies.legacySearchIngestionStats

chronicle.legacies.legacySearchIoCInsights

chronicle.legacies.legacySearchRawLogs

chronicle.legacies.legacySearchUserEvents

chronicle.logTypeSchemas.list

chronicle.logs.export

chronicle.logs.get

chronicle.logs.list

chronicle.messages.get

chronicle.messages.list

chronicle.multitenantDirectories.get

chronicle.nativeDashboards.get

chronicle.nativeDashboards.list

chronicle.notebooks.*

  • chronicle.notebooks.get
  • chronicle.notebooks.list

chronicle.operations.get

chronicle.operations.list

chronicle.operations.streamSearch

chronicle.operations.wait

chronicle.preferenceSets.*

  • chronicle.preferenceSets.get
  • chronicle.preferenceSets.update

chronicle.searchQueries.*

  • chronicle.searchQueries.create
  • chronicle.searchQueries.delete
  • chronicle.searchQueries.get
  • chronicle.searchQueries.list
  • chronicle.searchQueries.update

chronicle.threatCollectionFilterSet.get

chronicle.threatCollections.*

  • chronicle.threatCollections.fetchEntityMetadata
  • chronicle.threatCollections.fetchIocMatchMetadata
  • chronicle.threatCollections.fetchRelated
  • chronicle.threatCollections.fetchRuleMetadata
  • chronicle.threatCollections.get
  • chronicle.threatCollections.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.restrictedDataAccess)

Grants access to data controlled by Data Access Scopes. Intended to be refined by IAM Conditions.

chronicle.dataAccessScopes.permit

(roles/chronicle.restrictedDataAccessViewer)

Grants readonly access to Chronicle API resources without global data access scope.

chronicle.ais.*

  • chronicle.ais.createFeedback
  • chronicle.ais.translateUdmQuery
  • chronicle.ais.translateYlRule

chronicle.dashboardCharts.*

  • chronicle.dashboardCharts.get
  • chronicle.dashboardCharts.list

chronicle.dashboardQueries.*

  • chronicle.dashboardQueries.execute
  • chronicle.dashboardQueries.get
  • chronicle.dashboardQueries.list

chronicle.dataAccessScopes.list

chronicle.dataTableRows.bulkGet

chronicle.dataTableRows.get

chronicle.dataTableRows.list

chronicle.dataTables.get

chronicle.dataTables.list

chronicle.enrichmentCombination.get

chronicle.enrichmentControls.get

chronicle.enrichmentControls.list

chronicle.entities.find

chronicle.entities.findRelatedEntities

chronicle.entities.get

chronicle.entities.list

chronicle.entities.searchEntities

chronicle.entities.summarize

chronicle.entities.summarizeFromQuery

chronicle.events.batchGet

chronicle.events.fetchEnrichedEvent

chronicle.events.findUdmFieldValues

chronicle.events.get

chronicle.events.queryProductSourceStats

chronicle.events.searchRawLogs

chronicle.events.udmSearch

chronicle.events.validateQuery

chronicle.featuredContentNativeDashboards.get

chronicle.featuredContentNativeDashboards.list

chronicle.featuredContentSearchQueries.get

chronicle.featuredContentSearchQueries.list

chronicle.findingsGraphs.*

  • chronicle.findingsGraphs.exploreNode
  • chronicle.findingsGraphs.initializeGraph

chronicle.instances.generateCollectionAgentAuth

chronicle.instances.generateSoarAuthJwt

chronicle.instances.get

chronicle.instances.report

chronicle.legacies.legacyBatchGetCases

chronicle.legacies.legacyBatchGetCollections

chronicle.legacies.legacyFetchAlertsView

chronicle.legacies.legacyFetchUdmSearchCsv

chronicle.legacies.legacyFetchUdmSearchView

chronicle.legacies.legacyFindAssetEvents

chronicle.legacies.legacyFindRawLogs

chronicle.legacies.legacyFindUdmEvents

chronicle.legacies.legacyGetAlert

chronicle.legacies.legacyGetRuleCounts

chronicle.legacies.legacyGetRulesTrends

chronicle.legacies.legacyRunTestRule

chronicle.legacies.legacySearchArtifactEvents

chronicle.legacies.legacySearchArtifactIoCDetails

chronicle.legacies.legacySearchAssetEvents

chronicle.legacies.legacySearchCustomerStats

chronicle.legacies.legacySearchDomainsRecentlyRegistered

chronicle.legacies.legacySearchDomainsTimingStats

chronicle.legacies.legacySearchFindings

chronicle.legacies.legacySearchIngestionStats

chronicle.legacies.legacySearchIoCInsights

chronicle.legacies.legacySearchRawLogs

chronicle.legacies.legacySearchRuleDetectionCountBuckets

chronicle.legacies.legacySearchRuleDetectionEvents

chronicle.legacies.legacySearchRuleResults

chronicle.legacies.legacySearchRulesAlerts

chronicle.legacies.legacySearchUserEvents

chronicle.logs.get

chronicle.logs.list

chronicle.multitenantDirectories.get

chronicle.nativeDashboards.get

chronicle.nativeDashboards.list

chronicle.operations.get

chronicle.operations.list

chronicle.operations.streamSearch

chronicle.operations.wait

chronicle.preferenceSets.*

  • chronicle.preferenceSets.get
  • chronicle.preferenceSets.update

chronicle.referenceLists.get

chronicle.referenceLists.list

chronicle.referenceLists.verifyReferenceList

chronicle.retrohunts.get

chronicle.retrohunts.list

chronicle.ruleDeployments.get

chronicle.ruleDeployments.list

chronicle.ruleExecutionErrors.list

chronicle.rules.get

chronicle.rules.list

chronicle.rules.listRevisions

chronicle.rules.verifyRuleText

chronicle.searchQueries.*

  • chronicle.searchQueries.create
  • chronicle.searchQueries.delete
  • chronicle.searchQueries.get
  • chronicle.searchQueries.list
  • chronicle.searchQueries.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.serviceAgent)

Grants Chronicle scoped access to customer project

bigquery.connections.create

bigquery.connections.delegate

bigquery.connections.delete

bigquery.connections.get

bigquery.connections.getIamPolicy

bigquery.connections.list

bigquery.connections.update

bigquery.connections.updateTag

bigquery.connections.use

bigquery.datasets.create

bigquery.jobs.create

bigquery.jobs.get

bigquery.tables.create

bigquery.tables.delete

bigquery.tables.get

bigquery.tables.update

bigquery.tables.updateData

chronicle.dashboards.copy

chronicle.dashboards.create

chronicle.dashboards.get

chronicle.dashboards.list

chronicle.events.udmSearch

chronicle.instances.get

chronicle.legacies.legacyGetDetection

chronicle.legacies.legacySearchArtifactIoCDetails

chronicle.legacies.legacySearchAssetEvents

chronicle.legacies.legacySearchCuratedDetections

chronicle.legacies.legacySearchDetections

chronicle.legacies.legacySearchEnterpriseWideIoCs

chronicle.legacies.legacyStreamDetectionAlerts

chronicle.legacies.legacyUpdateAlert

chronicle.referenceLists.get

chronicle.referenceLists.list

chronicle.referenceLists.update

chronicle.retrohunts.create

chronicle.rules.get

monitoring.alertPolicies.create

monitoring.alertPolicies.delete

monitoring.alertPolicies.get

monitoring.alertPolicies.list

monitoring.alertPolicies.update

serviceusage.operations.get

serviceusage.quotas.get

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

storage.buckets.create

storage.buckets.get

storage.buckets.getIamPolicy

storage.buckets.setIamPolicy

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

(roles/chronicle.soarAdmin)

Grants admin access to Chronicle SOAR.

chronicle.alertGroupingRules.*

  • chronicle.alertGroupingRules.delete
  • chronicle.alertGroupingRules.get
  • chronicle.alertGroupingRules.update

chronicle.attachments.*

  • chronicle.attachments.delete
  • chronicle.attachments.get
  • chronicle.attachments.update

chronicle.caseAlerts.*

  • chronicle.caseAlerts.get
  • chronicle.caseAlerts.metadataUpdate
  • chronicle.caseAlerts.move
  • chronicle.caseAlerts.updateSla

chronicle.caseCloseDefinitions.*

  • chronicle.caseCloseDefinitions.delete
  • chronicle.caseCloseDefinitions.get
  • chronicle.caseCloseDefinitions.update

chronicle.caseComments.*

  • chronicle.caseComments.delete
  • chronicle.caseComments.get
  • chronicle.caseComments.update

chronicle.caseQueueFilters.*

  • chronicle.caseQueueFilters.delete
  • chronicle.caseQueueFilters.get
  • chronicle.caseQueueFilters.update

chronicle.caseStageDefinitions.*

  • chronicle.caseStageDefinitions.delete
  • chronicle.caseStageDefinitions.get
  • chronicle.caseStageDefinitions.update

chronicle.caseTagDefinitions.*

  • chronicle.caseTagDefinitions.delete
  • chronicle.caseTagDefinitions.get
  • chronicle.caseTagDefinitions.update

chronicle.caseWallRecords.*

  • chronicle.caseWallRecords.get
  • chronicle.caseWallRecords.update

chronicle.cases.*

  • chronicle.cases.close
  • chronicle.cases.countPriorities
  • chronicle.cases.generateReport
  • chronicle.cases.get
  • chronicle.cases.removeTag
  • chronicle.cases.reopen
  • chronicle.cases.update
  • chronicle.cases.updateTag

chronicle.chatMessages.*

  • chronicle.chatMessages.create
  • chronicle.chatMessages.get
  • chronicle.chatMessages.pin

chronicle.connectorInstanceLogs.get

chronicle.connectorInstances.*

  • chronicle.connectorInstances.delete
  • chronicle.connectorInstances.get
  • chronicle.connectorInstances.update

chronicle.connectorRevisions.*

  • chronicle.connectorRevisions.delete
  • chronicle.connectorRevisions.get
  • chronicle.connectorRevisions.update

chronicle.connectors.*

  • chronicle.connectors.delete
  • chronicle.connectors.get
  • chronicle.connectors.update

chronicle.contentPacks.*

  • chronicle.contentPacks.create
  • chronicle.contentPacks.delete
  • chronicle.contentPacks.export
  • chronicle.contentPacks.get
  • chronicle.contentPacks.install

chronicle.contextProperties.*

  • chronicle.contextProperties.delete
  • chronicle.contextProperties.get
  • chronicle.contextProperties.update

chronicle.customFieldValues.*

  • chronicle.customFieldValues.get
  • chronicle.customFieldValues.update

chronicle.customFields.*

  • chronicle.customFields.delete
  • chronicle.customFields.get
  • chronicle.customFields.update

chronicle.customLists.*

  • chronicle.customLists.delete
  • chronicle.customLists.get
  • chronicle.customLists.update

chronicle.emailTemplates.*

  • chronicle.emailTemplates.delete
  • chronicle.emailTemplates.get
  • chronicle.emailTemplates.update

chronicle.entitiesBlocklists.*

  • chronicle.entitiesBlocklists.delete
  • chronicle.entitiesBlocklists.get
  • chronicle.entitiesBlocklists.update

chronicle.environmentGroups.*

  • chronicle.environmentGroups.delete
  • chronicle.environmentGroups.get
  • chronicle.environmentGroups.update

chronicle.environments.*

  • chronicle.environments.delete
  • chronicle.environments.get
  • chronicle.environments.update

chronicle.formDynamicParameters.update

chronicle.instances.soarAdmin

chronicle.integrationActionRevisions.*

  • chronicle.integrationActionRevisions.delete
  • chronicle.integrationActionRevisions.get
  • chronicle.integrationActionRevisions.update

chronicle.integrationActions.*

  • chronicle.integrationActions.delete
  • chronicle.integrationActions.get
  • chronicle.integrationActions.run
  • chronicle.integrationActions.update

chronicle.integrationInstances.*

  • chronicle.integrationInstances.delete
  • chronicle.integrationInstances.get
  • chronicle.integrationInstances.update

chronicle.integrations.*

  • chronicle.integrations.delete
  • chronicle.integrations.get
  • chronicle.integrations.update

chronicle.involvedEntities.*

  • chronicle.involvedEntities.get
  • chronicle.involvedEntities.update

chronicle.jobInstanceLogs.get

chronicle.jobInstances.*

  • chronicle.jobInstances.delete
  • chronicle.jobInstances.get
  • chronicle.jobInstances.run
  • chronicle.jobInstances.update

chronicle.jobRevisions.*

  • chronicle.jobRevisions.delete
  • chronicle.jobRevisions.get
  • chronicle.jobRevisions.update

chronicle.jobs.*

  • chronicle.jobs.delete
  • chronicle.jobs.get
  • chronicle.jobs.update

chronicle.legacyCaseFederationPlatforms.*

  • chronicle.legacyCaseFederationPlatforms.delete
  • chronicle.legacyCaseFederationPlatforms.get
  • chronicle.legacyCaseFederationPlatforms.update

chronicle.legacyCases.*

  • chronicle.legacyCases.createSimulated
  • chronicle.legacyCases.deleteSimulated
  • chronicle.legacyCases.exportJson
  • chronicle.legacyCases.get
  • chronicle.legacyCases.getSimulated
  • chronicle.legacyCases.importJson
  • chronicle.legacyCases.ingest
  • chronicle.legacyCases.ingestAlertTestCase
  • chronicle.legacyCases.runManualAction
  • chronicle.legacyCases.simulate

chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration

chronicle.legacyFederatedCases.*

  • chronicle.legacyFederatedCases.batchPatchFederatedCases
  • chronicle.legacyFederatedCases.fetchCasesToSync
  • chronicle.legacyFederatedCases.get

chronicle.legacyPlaybooks.*

  • chronicle.legacyPlaybooks.delete
  • chronicle.legacyPlaybooks.export
  • chronicle.legacyPlaybooks.get
  • chronicle.legacyPlaybooks.import
  • chronicle.legacyPlaybooks.update

chronicle.legacyPublisher.*

  • chronicle.legacyPublisher.get
  • chronicle.legacyPublisher.update

chronicle.legacySdk.*

  • chronicle.legacySdk.get
  • chronicle.legacySdk.update

chronicle.legacySearches.*

  • chronicle.legacySearches.searchCases
  • chronicle.legacySearches.searchEntities

chronicle.legacySoarAdvancedReports.*

  • chronicle.legacySoarAdvancedReports.delete
  • chronicle.legacySoarAdvancedReports.get
  • chronicle.legacySoarAdvancedReports.share
  • chronicle.legacySoarAdvancedReports.update

chronicle.legacySoarAudits.legacySoarAudit

chronicle.legacySoarDashboards.*

  • chronicle.legacySoarDashboards.delete
  • chronicle.legacySoarDashboards.get
  • chronicle.legacySoarDashboards.update

chronicle.legacySoarIdpMappingGroups.*

  • chronicle.legacySoarIdpMappingGroups.delete
  • chronicle.legacySoarIdpMappingGroups.get
  • chronicle.legacySoarIdpMappingGroups.update

chronicle.legacySoarReports.*

  • chronicle.legacySoarReports.delete
  • chronicle.legacySoarReports.get
  • chronicle.legacySoarReports.update

chronicle.legacySoarSettings.*

  • chronicle.legacySoarSettings.get
  • chronicle.legacySoarSettings.update

chronicle.legacySoarUsers.*

  • chronicle.legacySoarUsers.delete
  • chronicle.legacySoarUsers.get

chronicle.legacySystem.*

  • chronicle.legacySystem.getLicenseStatus
  • chronicle.legacySystem.getMaximumDataRetentionValue
  • chronicle.legacySystem.getSystemVersion

chronicle.legacySystemMetadata.*

  • chronicle.legacySystemMetadata.get
  • chronicle.legacySystemMetadata.placeholders

chronicle.managerRevisions.*

  • chronicle.managerRevisions.delete
  • chronicle.managerRevisions.get
  • chronicle.managerRevisions.update

chronicle.managers.*

  • chronicle.managers.delete
  • chronicle.managers.get
  • chronicle.managers.update

chronicle.mappingRules.*

  • chronicle.mappingRules.delete
  • chronicle.mappingRules.get
  • chronicle.mappingRules.update

chronicle.marketplaceIntegrations.*

  • chronicle.marketplaceIntegrations.get
  • chronicle.marketplaceIntegrations.install
  • chronicle.marketplaceIntegrations.uninstall

chronicle.moduleSettings.*

  • chronicle.moduleSettings.get
  • chronicle.moduleSettings.rebranding

chronicle.moduleSettingsProperties.*

  • chronicle.moduleSettingsProperties.get
  • chronicle.moduleSettingsProperties.testSettings
  • chronicle.moduleSettingsProperties.update

chronicle.notificationSettings.*

  • chronicle.notificationSettings.get
  • chronicle.notificationSettings.update

chronicle.ontologyRecords.*

  • chronicle.ontologyRecords.get
  • chronicle.ontologyRecords.update

chronicle.propertySchemaDefinitions.*

  • chronicle.propertySchemaDefinitions.delete
  • chronicle.propertySchemaDefinitions.get
  • chronicle.propertySchemaDefinitions.update

chronicle.remoteAgents.*

  • chronicle.remoteAgents.delete
  • chronicle.remoteAgents.get
  • chronicle.remoteAgents.update

chronicle.requestTemplates.*

  • chronicle.requestTemplates.delete
  • chronicle.requestTemplates.get
  • chronicle.requestTemplates.update

chronicle.slaDefinitions.*

  • chronicle.slaDefinitions.delete
  • chronicle.slaDefinitions.get
  • chronicle.slaDefinitions.update

chronicle.soarDomains.*

  • chronicle.soarDomains.delete
  • chronicle.soarDomains.get
  • chronicle.soarDomains.update

chronicle.soarNetworks.*

  • chronicle.soarNetworks.delete
  • chronicle.soarNetworks.get
  • chronicle.soarNetworks.update

chronicle.socRoles.*

  • chronicle.socRoles.delete
  • chronicle.socRoles.get
  • chronicle.socRoles.update

chronicle.systemNotifications.*

  • chronicle.systemNotifications.get
  • chronicle.systemNotifications.update

chronicle.tasks.*

  • chronicle.tasks.delete
  • chronicle.tasks.get
  • chronicle.tasks.update

chronicle.uniqueEntities.*

  • chronicle.uniqueEntities.get
  • chronicle.uniqueEntities.update

chronicle.userLocalizations.*

  • chronicle.userLocalizations.get
  • chronicle.userLocalizations.update

chronicle.userNotifications.*

  • chronicle.userNotifications.get
  • chronicle.userNotifications.update

chronicle.views.*

  • chronicle.views.get
  • chronicle.views.update

chronicle.visualFamilies.*

  • chronicle.visualFamilies.delete
  • chronicle.visualFamilies.get
  • chronicle.visualFamilies.update

chronicle.webhooks.*

  • chronicle.webhooks.delete
  • chronicle.webhooks.get
  • chronicle.webhooks.ingestAlert
  • chronicle.webhooks.update

chronicle.workdeskContacts.*

  • chronicle.workdeskContacts.delete
  • chronicle.workdeskContacts.get
  • chronicle.workdeskContacts.update

chronicle.workdeskNotes.*

  • chronicle.workdeskNotes.delete
  • chronicle.workdeskNotes.get
  • chronicle.workdeskNotes.update

cloudasset.assets.exportResource

cloudasset.assets.queryAccessPolicy

cloudasset.assets.queryIamPolicy

cloudasset.assets.queryOSInventories

cloudasset.assets.queryResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

cloudasset.assets.searchEnrichmentResourceOwners

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

securitycenter.attackpaths.list

securitycenter.exposurepathexplan.get

securitycenter.findings.bulkMuteUpdate

securitycenter.findings.group

securitycenter.findings.list

securitycenter.findings.listFindingPropertyNames

securitycenter.findings.setMute

securitycenter.findings.setState

securitycenter.findings.update

securitycenter.findingsecuritymarks.update

securitycenter.simulations.get

securitycenter.userinterfacemetadata.get

securitycenter.valuedresources.list

(roles/chronicle.soarAnalyst)

Grants Analyist access to Chronicle SOAR.

chronicle.attachments.*

  • chronicle.attachments.delete
  • chronicle.attachments.get
  • chronicle.attachments.update

chronicle.caseAlerts.*

  • chronicle.caseAlerts.get
  • chronicle.caseAlerts.metadataUpdate
  • chronicle.caseAlerts.move
  • chronicle.caseAlerts.updateSla

chronicle.caseCloseDefinitions.get

chronicle.caseComments.*

  • chronicle.caseComments.delete
  • chronicle.caseComments.get
  • chronicle.caseComments.update

chronicle.caseQueueFilters.*

  • chronicle.caseQueueFilters.delete
  • chronicle.caseQueueFilters.get
  • chronicle.caseQueueFilters.update

chronicle.caseStageDefinitions.get

chronicle.caseTagDefinitions.get

chronicle.caseWallRecords.*

  • chronicle.caseWallRecords.get
  • chronicle.caseWallRecords.update

chronicle.cases.close

chronicle.cases.generateReport

chronicle.cases.get

chronicle.cases.removeTag

chronicle.cases.reopen

chronicle.cases.update

chronicle.cases.updateTag

chronicle.chatMessages.*

  • chronicle.chatMessages.create
  • chronicle.chatMessages.get
  • chronicle.chatMessages.pin

chronicle.contentPacks.get

chronicle.contextProperties.*

  • chronicle.contextProperties.delete
  • chronicle.contextProperties.get
  • chronicle.contextProperties.update

chronicle.customFieldValues.*

  • chronicle.customFieldValues.get
  • chronicle.customFieldValues.update

chronicle.customFields.get

chronicle.customLists.get

chronicle.emailTemplates.get

chronicle.entitiesBlocklists.get

chronicle.environmentGroups.get

chronicle.environments.get

chronicle.integrationActions.get

chronicle.integrationActions.run

chronicle.involvedEntities.*

  • chronicle.involvedEntities.get
  • chronicle.involvedEntities.update

chronicle.legacyCases.*

  • chronicle.legacyCases.createSimulated
  • chronicle.legacyCases.deleteSimulated
  • chronicle.legacyCases.exportJson
  • chronicle.legacyCases.get
  • chronicle.legacyCases.getSimulated
  • chronicle.legacyCases.importJson
  • chronicle.legacyCases.ingest
  • chronicle.legacyCases.ingestAlertTestCase
  • chronicle.legacyCases.runManualAction
  • chronicle.legacyCases.simulate

chronicle.legacySearches.*

  • chronicle.legacySearches.searchCases
  • chronicle.legacySearches.searchEntities

chronicle.legacySoarAdvancedReports.get

chronicle.legacySoarDashboards.get

chronicle.legacySoarReports.get

chronicle.legacySoarUsers.get

chronicle.legacySystemMetadata.get

chronicle.marketplaceIntegrations.get

chronicle.moduleSettings.rebranding

chronicle.notificationSettings.*

  • chronicle.notificationSettings.get
  • chronicle.notificationSettings.update

chronicle.ontologyRecords.get

chronicle.requestTemplates.get

chronicle.soarDomains.get

chronicle.soarNetworks.get

chronicle.tasks.*

  • chronicle.tasks.delete
  • chronicle.tasks.get
  • chronicle.tasks.update

chronicle.uniqueEntities.update

chronicle.userLocalizations.*

  • chronicle.userLocalizations.get
  • chronicle.userLocalizations.update

chronicle.userNotifications.*

  • chronicle.userNotifications.get
  • chronicle.userNotifications.update

chronicle.visualFamilies.get

chronicle.workdeskContacts.*

  • chronicle.workdeskContacts.delete
  • chronicle.workdeskContacts.get
  • chronicle.workdeskContacts.update

chronicle.workdeskNotes.*

  • chronicle.workdeskNotes.delete
  • chronicle.workdeskNotes.get
  • chronicle.workdeskNotes.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.soarEngineer)

Grants Engineer access to Chronicle SOAR.

chronicle.attachments.*

  • chronicle.attachments.delete
  • chronicle.attachments.get
  • chronicle.attachments.update

chronicle.caseAlerts.*

  • chronicle.caseAlerts.get
  • chronicle.caseAlerts.metadataUpdate
  • chronicle.caseAlerts.move
  • chronicle.caseAlerts.updateSla

chronicle.caseCloseDefinitions.*

  • chronicle.caseCloseDefinitions.delete
  • chronicle.caseCloseDefinitions.get
  • chronicle.caseCloseDefinitions.update

chronicle.caseComments.*

  • chronicle.caseComments.delete
  • chronicle.caseComments.get
  • chronicle.caseComments.update

chronicle.caseQueueFilters.*

  • chronicle.caseQueueFilters.delete
  • chronicle.caseQueueFilters.get
  • chronicle.caseQueueFilters.update

chronicle.caseStageDefinitions.get

chronicle.caseTagDefinitions.*

  • chronicle.caseTagDefinitions.delete
  • chronicle.caseTagDefinitions.get
  • chronicle.caseTagDefinitions.update

chronicle.caseWallRecords.*

  • chronicle.caseWallRecords.get
  • chronicle.caseWallRecords.update

chronicle.cases.close

chronicle.cases.generateReport

chronicle.cases.get

chronicle.cases.removeTag

chronicle.cases.reopen

chronicle.cases.update

chronicle.cases.updateTag

chronicle.chatMessages.*

  • chronicle.chatMessages.create
  • chronicle.chatMessages.get
  • chronicle.chatMessages.pin

chronicle.connectorInstanceLogs.get

chronicle.connectorInstances.*

  • chronicle.connectorInstances.delete
  • chronicle.connectorInstances.get
  • chronicle.connectorInstances.update

chronicle.connectorRevisions.*

  • chronicle.connectorRevisions.delete
  • chronicle.connectorRevisions.get
  • chronicle.connectorRevisions.update

chronicle.contentPacks.*

  • chronicle.contentPacks.create
  • chronicle.contentPacks.delete
  • chronicle.contentPacks.export
  • chronicle.contentPacks.get
  • chronicle.contentPacks.install

chronicle.contextProperties.*

  • chronicle.contextProperties.delete
  • chronicle.contextProperties.get
  • chronicle.contextProperties.update

chronicle.customFieldValues.*

  • chronicle.customFieldValues.get
  • chronicle.customFieldValues.update

chronicle.customFields.get

chronicle.customLists.get

chronicle.emailTemplates.get

chronicle.entitiesBlocklists.get

chronicle.environmentGroups.get

chronicle.environments.get

chronicle.integrationActionRevisions.*

  • chronicle.integrationActionRevisions.delete
  • chronicle.integrationActionRevisions.get
  • chronicle.integrationActionRevisions.update

chronicle.integrationActions.get

chronicle.integrationActions.run

chronicle.integrationActions.update

chronicle.integrationInstances.*

  • chronicle.integrationInstances.delete
  • chronicle.integrationInstances.get
  • chronicle.integrationInstances.update

chronicle.integrations.get

chronicle.integrations.update

chronicle.involvedEntities.*

  • chronicle.involvedEntities.get
  • chronicle.involvedEntities.update

chronicle.jobInstanceLogs.get

chronicle.jobInstances.*

  • chronicle.jobInstances.delete
  • chronicle.jobInstances.get
  • chronicle.jobInstances.run
  • chronicle.jobInstances.update

chronicle.jobRevisions.*

  • chronicle.jobRevisions.delete
  • chronicle.jobRevisions.get
  • chronicle.jobRevisions.update

chronicle.jobs.get

chronicle.jobs.update

chronicle.legacyCases.*

  • chronicle.legacyCases.createSimulated
  • chronicle.legacyCases.deleteSimulated
  • chronicle.legacyCases.exportJson
  • chronicle.legacyCases.get
  • chronicle.legacyCases.getSimulated
  • chronicle.legacyCases.importJson
  • chronicle.legacyCases.ingest
  • chronicle.legacyCases.ingestAlertTestCase
  • chronicle.legacyCases.runManualAction
  • chronicle.legacyCases.simulate

chronicle.legacyPlaybooks.*

  • chronicle.legacyPlaybooks.delete
  • chronicle.legacyPlaybooks.export
  • chronicle.legacyPlaybooks.get
  • chronicle.legacyPlaybooks.import
  • chronicle.legacyPlaybooks.update

chronicle.legacySearches.*

  • chronicle.legacySearches.searchCases
  • chronicle.legacySearches.searchEntities

chronicle.legacySoarAdvancedReports.*

  • chronicle.legacySoarAdvancedReports.delete
  • chronicle.legacySoarAdvancedReports.get
  • chronicle.legacySoarAdvancedReports.share
  • chronicle.legacySoarAdvancedReports.update

chronicle.legacySoarDashboards.*

  • chronicle.legacySoarDashboards.delete
  • chronicle.legacySoarDashboards.get
  • chronicle.legacySoarDashboards.update

chronicle.legacySoarReports.*

  • chronicle.legacySoarReports.delete
  • chronicle.legacySoarReports.get
  • chronicle.legacySoarReports.update

chronicle.legacySoarUsers.get

chronicle.legacySystemMetadata.get

chronicle.managerRevisions.*

  • chronicle.managerRevisions.delete
  • chronicle.managerRevisions.get
  • chronicle.managerRevisions.update

chronicle.managers.*

  • chronicle.managers.delete
  • chronicle.managers.get
  • chronicle.managers.update

chronicle.marketplaceIntegrations.*

  • chronicle.marketplaceIntegrations.get
  • chronicle.marketplaceIntegrations.install
  • chronicle.marketplaceIntegrations.uninstall

chronicle.moduleSettings.rebranding

chronicle.notificationSettings.*

  • chronicle.notificationSettings.get
  • chronicle.notificationSettings.update

chronicle.ontologyRecords.get

chronicle.remoteAgents.*

  • chronicle.remoteAgents.delete
  • chronicle.remoteAgents.get
  • chronicle.remoteAgents.update

chronicle.requestTemplates.get

chronicle.soarDomains.get

chronicle.soarNetworks.get

chronicle.tasks.*

  • chronicle.tasks.delete
  • chronicle.tasks.get
  • chronicle.tasks.update

chronicle.uniqueEntities.*

  • chronicle.uniqueEntities.get
  • chronicle.uniqueEntities.update

chronicle.userLocalizations.*

  • chronicle.userLocalizations.get
  • chronicle.userLocalizations.update

chronicle.userNotifications.*

  • chronicle.userNotifications.get
  • chronicle.userNotifications.update

chronicle.visualFamilies.get

chronicle.webhooks.*

  • chronicle.webhooks.delete
  • chronicle.webhooks.get
  • chronicle.webhooks.ingestAlert
  • chronicle.webhooks.update

chronicle.workdeskContacts.*

  • chronicle.workdeskContacts.delete
  • chronicle.workdeskContacts.get
  • chronicle.workdeskContacts.update

chronicle.workdeskNotes.*

  • chronicle.workdeskNotes.delete
  • chronicle.workdeskNotes.get
  • chronicle.workdeskNotes.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.soarServiceAgent)

Gives Chronicle SOAR the ability to perform remediation on Cloud Platform resources.

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.exportIamPolicy

cloudasset.assets.exportResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

compute.firewalls.get

compute.firewalls.update

compute.globalOperations.get

compute.instances.deleteAccessConfig

compute.instances.get

compute.instances.list

compute.instances.stop

compute.instances.updateNetworkInterface

compute.networks.updatePolicy

compute.regionOperations.get

compute.zoneOperations.get

compute.zones.list

iam.serviceAccounts.disable

iam.serviceAccounts.list

recommender.iamPolicyRecommendations.*

  • recommender.iamPolicyRecommendations.get
  • recommender.iamPolicyRecommendations.list
  • recommender.iamPolicyRecommendations.update

resourcemanager.organizations.getIamPolicy

securitycenter.findingexternalsystems.update

securitycenter.findings.list

securitycenter.findings.setMute

securitycenter.findings.setState

securitycenter.findings.update

securitycenter.notificationconfig.create

securitycenter.notificationconfig.delete

securitycenter.notificationconfig.get

securitycenter.notificationconfig.update

securitycenter.sources.list

storage.buckets.get

storage.buckets.getIamPolicy

storage.buckets.list

storage.buckets.update

(roles/chronicle.soarThreatManager)

Grants threat manager access to Chronicle SOAR.

chronicle.instances.soarThreatManager

cloudasset.assets.exportResource

cloudasset.assets.queryAccessPolicy

cloudasset.assets.queryIamPolicy

cloudasset.assets.queryOSInventories

cloudasset.assets.queryResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

cloudasset.assets.searchEnrichmentResourceOwners

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

securitycenter.attackpaths.list

securitycenter.exposurepathexplan.get

securitycenter.findings.bulkMuteUpdate

securitycenter.findings.group

securitycenter.findings.list

securitycenter.findings.listFindingPropertyNames

securitycenter.findings.setMute

securitycenter.findings.setState

securitycenter.findings.update

securitycenter.findingsecuritymarks.update

securitycenter.simulations.get

securitycenter.userinterfacemetadata.get

securitycenter.valuedresources.list

(roles/chronicle.soarViewer)

Grants Viewer access to Chronicle SOAR.

chronicle.attachments.get

chronicle.caseAlerts.get

chronicle.caseCloseDefinitions.get

chronicle.caseComments.get

chronicle.caseQueueFilters.get

chronicle.caseTagDefinitions.get

chronicle.cases.generateReport

chronicle.cases.get

chronicle.chatMessages.get

chronicle.contentPacks.get

chronicle.contextProperties.get

chronicle.customFieldValues.get

chronicle.customFields.get

chronicle.environmentGroups.get

chronicle.environments.get

chronicle.integrationActions.get

chronicle.involvedEntities.get

chronicle.legacyCases.get

chronicle.legacySearches.*

  • chronicle.legacySearches.searchCases
  • chronicle.legacySearches.searchEntities

chronicle.legacySoarAdvancedReports.get

chronicle.legacySoarDashboards.get

chronicle.legacySoarReports.get

chronicle.legacySoarUsers.get

chronicle.legacySystemMetadata.get

chronicle.marketplaceIntegrations.get

chronicle.moduleSettings.rebranding

chronicle.requestTemplates.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/chronicle.soarVulnerabilityManager)

Grants vulnerability manager access to Chronicle SOAR.

chronicle.instances.soarVulnerabilityManager

cloudasset.assets.exportResource

cloudasset.assets.queryAccessPolicy

cloudasset.assets.queryIamPolicy

cloudasset.assets.queryOSInventories

cloudasset.assets.queryResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

cloudasset.assets.searchEnrichmentResourceOwners

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

securitycenter.attackpaths.list

securitycenter.exposurepathexplan.get

securitycenter.findings.bulkMuteUpdate

securitycenter.findings.group

securitycenter.findings.list

securitycenter.findings.listFindingPropertyNames

securitycenter.findings.setMute

securitycenter.findings.setState

securitycenter.findings.update

securitycenter.findingsecuritymarks.update

securitycenter.simulations.get

securitycenter.userinterfacemetadata.get

securitycenter.valuedresources.list

(roles/chronicle.viewer)

Read-only access to the Chronicle API resources.

chronicle.ais.*

  • chronicle.ais.createFeedback
  • chronicle.ais.translateUdmQuery
  • chronicle.ais.translateYlRule

chronicle.analyticValues.list

chronicle.analytics.list

chronicle.bigQueryExport.get

chronicle.cases.countPriorities

chronicle.collectors.get

chronicle.collectors.list

chronicle.conversations.get

chronicle.conversations.list

chronicle.curatedRuleSetCategories.*

  • chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections
  • chronicle.curatedRuleSetCategories.get
  • chronicle.curatedRuleSetCategories.list

chronicle.curatedRuleSetDeployments.get

chronicle.curatedRuleSetDeployments.list

chronicle.curatedRuleSets.*

  • chronicle.curatedRuleSets.countCuratedRuleSetDetections
  • chronicle.curatedRuleSets.get
  • chronicle.curatedRuleSets.list

chronicle.curatedRules.*

  • chronicle.curatedRules.get
  • chronicle.curatedRules.list

chronicle.dashboardCharts.*

  • chronicle.dashboardCharts.get
  • chronicle.dashboardCharts.list

chronicle.dashboardQueries.*

  • chronicle.dashboardQueries.execute
  • chronicle.dashboardQueries.get
  • chronicle.dashboardQueries.list

chronicle.dashboards.get

chronicle.dashboards.list

chronicle.dashboards.schedule

chronicle.dataAccessScopes.list

chronicle.dataExports.fetchLogTypesAvailableForExport

chronicle.dataExports.get

chronicle.dataTableOperationErrors.get

chronicle.dataTableRows.bulkGet

chronicle.dataTableRows.get

chronicle.dataTableRows.list

chronicle.dataTables.get

chronicle.dataTables.list

chronicle.dataTaps.get

chronicle.dataTaps.list

chronicle.enrichmentCombination.get

chronicle.enrichmentControls.get

chronicle.enrichmentControls.list

chronicle.entities.find

chronicle.entities.findRelatedEntities

chronicle.entities.get

chronicle.entities.list

chronicle.entities.queryEntityRiskScoreModifications

chronicle.entities.searchEntities

chronicle.entities.summarize

chronicle.entities.summarizeFromQuery

chronicle.entityRiskScores.queryEntityRiskScores

chronicle.errorNotificationConfigs.get

chronicle.errorNotificationConfigs.list

chronicle.events.batchGet

chronicle.events.fetchEnrichedEvent

chronicle.events.findUdmFieldValues

chronicle.events.get

chronicle.events.queryProductSourceStats

chronicle.events.searchRawLogs

chronicle.events.udmSearch

chronicle.events.validateQuery

chronicle.featuredContentNativeDashboards.get

chronicle.featuredContentNativeDashboards.list

chronicle.featuredContentRules.list

chronicle.featuredContentSearchQueries.get

chronicle.featuredContentSearchQueries.list

chronicle.feedPacks.*

  • chronicle.feedPacks.get
  • chronicle.feedPacks.list

chronicle.findingsGraphs.*

  • chronicle.findingsGraphs.exploreNode
  • chronicle.findingsGraphs.initializeGraph

chronicle.findingsRefinementDeployments.get

chronicle.findingsRefinementDeployments.list

chronicle.findingsRefinements.computeActivity

chronicle.findingsRefinements.computeAllActivities

chronicle.findingsRefinements.get

chronicle.findingsRefinements.list

chronicle.findingsRefinements.test

chronicle.formDynamicParameters.get

chronicle.forwarders.generate

chronicle.forwarders.get

chronicle.forwarders.list

chronicle.globalDataAccessScopes.permit

chronicle.ingestionLogLabels.*

  • chronicle.ingestionLogLabels.get
  • chronicle.ingestionLogLabels.list

chronicle.ingestionLogNamespaces.*

  • chronicle.ingestionLogNamespaces.get
  • chronicle.ingestionLogNamespaces.list

chronicle.instances.generateCollectionAgentAuth

chronicle.instances.generateSoarAuthJwt

chronicle.instances.get

chronicle.instances.logTypeClassifier

chronicle.instances.report

chronicle.investigationSteps.*

  • chronicle.investigationSteps.get
  • chronicle.investigationSteps.list

chronicle.investigations.get

chronicle.investigations.list

chronicle.iocAssociations.*

  • chronicle.iocAssociations.batchGet
  • chronicle.iocAssociations.fetchRelated
  • chronicle.iocAssociations.fetchRelatedIocAssociations
  • chronicle.iocAssociations.fetchRelatedThreatCollections
  • chronicle.iocAssociations.get

chronicle.iocMatches.*

  • chronicle.iocMatches.get
  • chronicle.iocMatches.list

chronicle.iocState.get

chronicle.iocs.*

  • chronicle.iocs.batchGet
  • chronicle.iocs.fetchRelated
  • chronicle.iocs.findFirstAndLastSeen
  • chronicle.iocs.findIocs
  • chronicle.iocs.get
  • chronicle.iocs.searchCuratedDetectionsForIoc

chronicle.legacies.legacyBatchGetCases

chronicle.legacies.legacyBatchGetCollections

chronicle.legacies.legacyFetchAlertsView

chronicle.legacies.legacyFetchUdmSearchCsv

chronicle.legacies.legacyFetchUdmSearchView

chronicle.legacies.legacyFindAssetEvents

chronicle.legacies.legacyFindRawLogs

chronicle.legacies.legacyFindUdmEvents

chronicle.legacies.legacyGetAlert

chronicle.legacies.legacyGetCuratedRulesTrends

chronicle.legacies.legacyGetDetection

chronicle.legacies.legacyGetEventForDetection

chronicle.legacies.legacyGetRuleCounts

chronicle.legacies.legacyGetRulesTrends

chronicle.legacies.legacyRunTestRule

chronicle.legacies.legacySearchArtifactEvents

chronicle.legacies.legacySearchArtifactIoCDetails

chronicle.legacies.legacySearchAssetEvents

chronicle.legacies.legacySearchCuratedDetections

chronicle.legacies.legacySearchCustomerStats

chronicle.legacies.legacySearchDetections

chronicle.legacies.legacySearchDomainsRecentlyRegistered

chronicle.legacies.legacySearchDomainsTimingStats

chronicle.legacies.legacySearchEnterpriseWideAlerts

chronicle.legacies.legacySearchEnterpriseWideIoCs

chronicle.legacies.legacySearchFindings

chronicle.legacies.legacySearchIngestionStats

chronicle.legacies.legacySearchIoCInsights

chronicle.legacies.legacySearchRawLogs

chronicle.legacies.legacySearchRuleDetectionCountBuckets

chronicle.legacies.legacySearchRuleDetectionEvents

chronicle.legacies.legacySearchRuleResults

chronicle.legacies.legacySearchRulesAlerts

chronicle.legacies.legacySearchUserEvents

chronicle.legacies.legacyStreamDetectionAlerts

chronicle.legacies.legacyTestRuleStreaming

chronicle.logTypeSchemas.list

chronicle.logs.export

chronicle.logs.get

chronicle.logs.list

chronicle.messages.get

chronicle.messages.list

chronicle.multitenantDirectories.get

chronicle.nativeDashboards.get

chronicle.nativeDashboards.list

chronicle.notebooks.*

  • chronicle.notebooks.get
  • chronicle.notebooks.list

chronicle.operations.get

chronicle.operations.list

chronicle.operations.streamSearch

chronicle.operations.wait

chronicle.preferenceSets.*

  • chronicle.preferenceSets.get
  • chronicle.preferenceSets.update

chronicle.referenceLists.get

chronicle.referenceLists.list

chronicle.referenceLists.verifyReferenceList

chronicle.retrohunts.get

chronicle.retrohunts.list

chronicle.riskConfigs.get

chronicle.ruleDeployments.get

chronicle.ruleDeployments.list

chronicle.ruleExecutionErrors.list

chronicle.rules.get

chronicle.rules.list

chronicle.rules.listRevisions

chronicle.rules.verifyRuleText

chronicle.searchQueries.*

  • chronicle.searchQueries.create
  • chronicle.searchQueries.delete
  • chronicle.searchQueries.get
  • chronicle.searchQueries.list
  • chronicle.searchQueries.update

chronicle.threatCollectionFilterSet.get

chronicle.threatCollections.*

  • chronicle.threatCollections.fetchEntityMetadata
  • chronicle.threatCollections.fetchIocMatchMetadata
  • chronicle.threatCollections.fetchRelated
  • chronicle.threatCollections.fetchRuleMetadata
  • chronicle.threatCollections.get
  • chronicle.threatCollections.list

chronicle.watchlists.get

chronicle.watchlists.list

resourcemanager.projects.get

resourcemanager.projects.list

Google Security Operations permissions

Permission Included in roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Restricted Data Access (roles/chronicle.restrictedDataAccess)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Owner (roles/owner)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Chronicle API Federation Viewer (roles/chronicle.federationViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Chronicle API Federation Viewer (roles/chronicle.federationViewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Global Data Access (roles/chronicle.globalDataAccess)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Data Governor (roles/chronicle.dataGovernor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Federation Admin (roles/chronicle.federationAdmin)

Chronicle API Federation Viewer (roles/chronicle.federationViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Threat Manager (roles/chronicle.soarThreatManager)

Owner (roles/owner)

Chronicle SOAR Vulnerability Manager (roles/chronicle.soarVulnerabilityManager)

Owner (roles/owner)

Chronicle API Data Governor (roles/chronicle.dataGovernor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Chronicle SOAR Viewer (roles/chronicle.soarViewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Service agent roles

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Limited Viewer (roles/chronicle.limitedViewer)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Chronicle API Viewer (roles/chronicle.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Chronicle API Admin (roles/chronicle.admin)

Chronicle API Editor (roles/chronicle.editor)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)

Support User (roles/iam.supportUser)

Owner (roles/owner)

Editor (roles/editor)

Chronicle SOAR Admin (roles/chronicle.soarAdmin)

Chronicle SOAR Analyst (roles/chronicle.soarAnalyst)

Chronicle SOAR Engineer (roles/chronicle.soarEngineer)