Complete Action Reference & Scoping Catalog
Every permission in the platform follows the grammar below. This is the same catalog that powers the Effective Permissions panel, the policy editor's autocomplete, and every access-denied message in the product - the same action string always means the same thing everywhere you encounter it.
Canonical Action Grammar
Every action string follows the same three-segment pattern:
service:module:operation- service: Either
iam(identity and access control) orsiem(everything else in the platform). - module: The targeted capability (e.g.
case,incident,loganalysis,policy,role). - operation: The action verb (e.g.
read,create,update,delete,assumeRole).
A quick note on how to read the "Resource" and "Scope" columns below: a resource restriction limits which specific thing (an asset, a case) the permission applies to. A scope restriction limits it along a second, independent axis - typically an ID-based filter for a read action, or a fixed own restriction for a mutation. Where a cell reads "-", that axis isn't supported for that action at all.
IAM Administration Catalog
Actions governing policies, roles, groups, direct user attachments, team members, and the IAM dashboard and audit log:
| Action String | Resource | Scope | Prerequisite Read |
|---|---|---|---|
| iam:policies:read | - | - | None |
| iam:policy:read | - | policy ID | iam:policies:read |
| iam:policy:create | - | - | iam:policies:read |
| iam:policy:update | - | policy ID | iam:policies:read |
| iam:policy:delete | - | policy ID | iam:policies:read |
| iam:roles:read | - | role ID | None |
| iam:role:read | - | role ID | iam:roles:read |
| iam:role:readPermissions | - | role ID | iam:role:read |
| iam:role:create | - | - | iam:roles:read |
| iam:role:update | - | role ID | iam:roles:read |
| iam:role:delete | - | role ID | iam:roles:read |
| iam:role:attachPolicy | - | role ID | iam:policies:read |
| iam:role:detachPolicy | - | role ID | iam:roles:read |
| iam:role:attachBoundary | - | role ID | iam:policies:read |
| iam:role:detachBoundary | - | role ID | iam:roles:read |
| iam:role:assumeRole | - | role ID | None |
| iam:groups:read | - | group ID | None |
| iam:group:read | - | group ID | iam:groups:read |
| iam:group:readPermissions | - | group ID | iam:group:read |
| iam:group:create | - | - | iam:groups:read |
| iam:group:update | - | group ID | iam:groups:read |
| iam:group:delete | - | group ID | iam:groups:read |
| iam:group:attachPolicy | - | group ID | iam:policies:read |
| iam:group:detachPolicy | - | group ID | iam:groups:read |
| iam:user:attachPolicy | - | user ID | iam:policies:read |
| iam:user:detachPolicy | - | user ID | iam:users:read |
| iam:user:attachBoundary | - | user ID | iam:policies:read |
| iam:user:detachBoundary | - | user ID | iam:users:read |
| iam:user:attachRole | - | user ID | iam:roles:read |
| iam:user:detachRole | - | user ID | iam:users:read |
| iam:user:attachGroup | - | user ID | iam:groups:read |
| iam:user:detachGroup | - | user ID | iam:users:read |
| iam:users:read | - | user ID | None |
| iam:user:read | - | user ID | iam:users:read |
| iam:user:readPermissions | - | user ID | iam:user:read |
| iam:user:create | - | - | iam:users:read |
| iam:user:update | - | user ID | iam:users:read |
| iam:iamdashboard:read | - | - | None |
| iam:audit:read | - | - | None |
SIEM Operations Catalog
Actions governing telemetry, investigation, and response:
| Action String | Resource | Scope | Prerequisite Read |
|---|---|---|---|
| siem:dashboard:read | agent ID | - | None |
| siem:inventory:read | agent ID | inventory section | None |
| siem:loganalysis:read | agent ID | - | None |
| siem:correlation:read | agent ID | - | None |
| siem:mitre:read | agent ID | - | None |
| siem:incidenttree:read | agent ID | - | None |
| siem:customincidenttree:read | agent ID | - | None |
| siem:filterincidenttree:read | agent ID | - | None |
| siem:incidentsummary:read | agent ID | - | None |
| siem:incident:read | agent ID | - | None |
| siem:incident:update | agent ID | - | siem:incident:read |
| siem:incident:markAsIncident | agent ID | - | siem:incidentsummary:read |
| siem:case:read | - | - | None |
| siem:case:create | - | - | siem:case:read |
| siem:caseassignment:update | case ID(s), or "own" | user ID(s) | siem:case:read |
| siem:case:update | - | own | siem:case:read |
| siem:case:resolve | - | own | siem:case:read |
| siem:case:delete | - | own | siem:case:read |
| siem:case:communicate | - | own | siem:case:read |
| siem:case:addIncident | - | own | siem:case:read |
| siem:widget:read | - | widget ID | None |
| siem:widget:create | agent ID | - | siem:widget:read |
| siem:widget:update | agent ID | - | siem:widget:read |
| siem:widget:delete | - | own | siem:widget:read |
| siem:workspace:read | - | workspace ID | None |
| siem:workspace:create | - | - | siem:workspace:read |
| siem:workspace:update | - | own | siem:workspace:read |
| siem:workspace:delete | - | own | siem:workspace:read |
| siem:report:read | agent ID | timeline type | None |
| siem:agentless:read | - | - | None |
| siem:aidetections:read | - | - | None |
| siem:aifeedback:update | - | - | siem:aidetections:read |
Account, Notifications & Billing
Actions governing a team member's own alert preferences, notification delivery, and subscription/billing administration:
| Action String | Resource | Scope | Prerequisite Read |
|---|---|---|---|
| siem:teamalertconfig:read | - | user ID | None |
| siem:teamalertconfig:update | - | user ID | siem:teamalertconfig:read |
| siem:notification:receiveseverityalerts | agent ID | - | None |
| siem:notification:receivesystemalerts | agent ID | - | None |
| siem:notification:receivesubscription | - | - | None |
| siem:notification:delete | - | - | None |
| siem:subscription:read | - | - | None |
| siem:subscription:upgrade | - | - | siem:subscription:read |
| siem:subscription:downgrade | - | - | siem:subscription:read |
| siem:subscription:cancel | - | - | siem:subscription:read |
| siem:subscription:resume | - | - | siem:subscription:read |
| siem:assetname:edit | - | - | siem:subscription:read |
| siem:billing:retry | - | - | siem:subscription:read |
| siem:billing:portal | - | - | siem:subscription:read |
| siem:paymentmethods:read | - | - | None |
| siem:paymentmethods:create | - | - | siem:paymentmethods:read |
| siem:paymentmethods:update | - | - | siem:paymentmethods:read |
| siem:paymentmethods:delete | - | - | siem:paymentmethods:read |
Special Scoping Semantics
A handful of actions carry scoping rules worth calling out on their own:
Case assignment is the one dual-meaning action
siem:caseassignment:update, the resource axis and the scope axis mean genuinely different things at the same time: resource limits which case IDs (or just the caller's own cases) can be reassigned, while scope separately limits which user IDs the caller is allowed to assign onto them. A team lead can hold this scoped so they can only assign work on their own team's cases, and only to members of their own team.Reports and inventory scope differently
siem:report:read, scope filters report periods (daily, weekly, monthly, quarterly, a fixed calendar quarter, or a custom range). On siem:inventory:read, scope filters inventory categories (host details, network, open ports, installed software, running processes) - independently of which assets the resource axis covers.Dependency Checking
Most mutation actions above list a prerequisite read action. Some permissions only make sense alongside another one - you can't meaningfully be granted "resolve a case" without also being able to view cases. The system checks for this whenever a policy is built or attached, and flags a grant that's missing its prerequisite, without necessarily blocking it - so you don't end up with a permission that's technically present but unusable in practice.