Permission	admin	editor	soarAdmin	viewer	limitedViewer	restrictedDataAccessViewer	serviceAgent	soarServiceAgent	soarThreatManager	soarVulnerabilityManager	federationAdmin	soarRemoteAgent	federationViewer	dataGovernor	globalDataAccess	restrictedDataAccess
bigquery.connections.create							✔
bigquery.connections.delegate							✔
bigquery.connections.delete							✔
bigquery.connections.get							✔
bigquery.connections.getIamPolicy							✔
bigquery.connections.list							✔
bigquery.connections.update							✔
bigquery.connections.updateTag							✔
bigquery.connections.use							✔
bigquery.datasets.create							✔
bigquery.jobs.create							✔
bigquery.jobs.get							✔
bigquery.tables.create							✔
bigquery.tables.delete							✔
bigquery.tables.get							✔
bigquery.tables.update							✔
bigquery.tables.updateData							✔
chronicle.agentSettings.get	✔	✔		✔	✔
chronicle.agentSettings.update	✔	✔
chronicle.ais.createFeedback	✔	✔		✔		✔
chronicle.ais.translateUdmQuery	✔	✔		✔		✔
chronicle.ais.translateYlRule	✔	✔		✔		✔
chronicle.alertGroupingRules.delete	✔		✔
chronicle.alertGroupingRules.get	✔		✔
chronicle.alertGroupingRules.update	✔		✔
chronicle.analyticValues.list	✔	✔		✔	✔
chronicle.analytics.list	✔	✔		✔	✔
chronicle.announcements.delete	✔		✔
chronicle.announcements.get	✔	✔	✔	✔
chronicle.announcements.update	✔		✔
chronicle.attachments.delete	✔	✔	✔
chronicle.attachments.get	✔	✔	✔	✔
chronicle.attachments.update	✔	✔	✔
chronicle.bigQueryAccess.provide	✔
chronicle.bigQueryExport.get	✔	✔		✔
chronicle.bigQueryExport.provision	✔
chronicle.bigQueryExport.update	✔
chronicle.calculatedFieldDefinitions.delete	✔		✔
chronicle.calculatedFieldDefinitions.get	✔	✔	✔	✔
chronicle.calculatedFieldDefinitions.update	✔		✔
chronicle.caseAlerts.get	✔	✔	✔	✔
chronicle.caseAlerts.metadataUpdate	✔	✔	✔
chronicle.caseAlerts.move	✔	✔	✔
chronicle.caseAlerts.updateSla	✔	✔	✔
chronicle.caseCloseDefinitions.delete	✔	✔	✔
chronicle.caseCloseDefinitions.get	✔	✔	✔	✔
chronicle.caseCloseDefinitions.update	✔	✔	✔
chronicle.caseComments.delete	✔	✔	✔
chronicle.caseComments.get	✔	✔	✔	✔
chronicle.caseComments.update	✔	✔	✔				✔
chronicle.caseQueueFilters.delete	✔	✔	✔
chronicle.caseQueueFilters.get	✔	✔	✔	✔
chronicle.caseQueueFilters.update	✔	✔	✔
chronicle.caseStageDefinitions.delete	✔		✔
chronicle.caseStageDefinitions.get	✔	✔	✔
chronicle.caseStageDefinitions.update	✔		✔
chronicle.caseTagDefinitions.delete	✔	✔	✔
chronicle.caseTagDefinitions.get	✔	✔	✔	✔
chronicle.caseTagDefinitions.update	✔	✔	✔
chronicle.caseWallRecords.get	✔	✔	✔
chronicle.caseWallRecords.update	✔	✔	✔
chronicle.cases.close	✔	✔	✔
chronicle.cases.countPriorities	✔	✔	✔	✔	✔
chronicle.cases.generateReport	✔	✔	✔	✔
chronicle.cases.get	✔	✔	✔	✔
chronicle.cases.removeTag	✔	✔	✔
chronicle.cases.reopen	✔	✔	✔
chronicle.cases.update	✔	✔	✔
chronicle.cases.updateTag	✔	✔	✔
chronicle.chatMessages.create	✔	✔	✔
chronicle.chatMessages.get	✔	✔	✔	✔
chronicle.chatMessages.pin	✔	✔	✔
chronicle.collectors.create	✔
chronicle.collectors.delete	✔
chronicle.collectors.get	✔	✔		✔
chronicle.collectors.list	✔	✔		✔
chronicle.collectors.update	✔
chronicle.connectorInstanceLogs.get	✔	✔	✔
chronicle.connectorInstances.delete	✔	✔	✔
chronicle.connectorInstances.get	✔	✔	✔
chronicle.connectorInstances.update	✔	✔	✔
chronicle.connectorRevisions.delete	✔	✔	✔
chronicle.connectorRevisions.get	✔	✔	✔
chronicle.connectorRevisions.update	✔	✔	✔
chronicle.connectors.delete	✔		✔
chronicle.connectors.get	✔		✔
chronicle.connectors.update	✔		✔
chronicle.contentPacks.create	✔	✔	✔
chronicle.contentPacks.delete	✔	✔	✔
chronicle.contentPacks.export	✔	✔	✔
chronicle.contentPacks.get	✔	✔	✔	✔
chronicle.contentPacks.install	✔	✔	✔
chronicle.contextProperties.delete	✔	✔	✔
chronicle.contextProperties.get	✔	✔	✔	✔
chronicle.contextProperties.update	✔	✔	✔
chronicle.conversations.create	✔	✔					✔
chronicle.conversations.delete	✔	✔
chronicle.conversations.get	✔	✔		✔	✔
chronicle.conversations.list	✔	✔		✔	✔
chronicle.conversations.update	✔	✔
chronicle.coverageDetails.get	✔	✔		✔	✔
chronicle.coverageDetails.list	✔	✔		✔	✔
chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections	✔	✔		✔
chronicle.curatedRuleSetCategories.get	✔	✔		✔
chronicle.curatedRuleSetCategories.list	✔	✔		✔
chronicle.curatedRuleSetDeployments.batchUpdate	✔	✔
chronicle.curatedRuleSetDeployments.get	✔	✔		✔
chronicle.curatedRuleSetDeployments.list	✔	✔		✔
chronicle.curatedRuleSetDeployments.update	✔	✔
chronicle.curatedRuleSets.countCuratedRuleSetDetections	✔	✔		✔
chronicle.curatedRuleSets.get	✔	✔		✔
chronicle.curatedRuleSets.list	✔	✔		✔
chronicle.curatedRules.get	✔	✔		✔
chronicle.curatedRules.list	✔	✔		✔
chronicle.customFieldValues.get	✔	✔	✔	✔
chronicle.customFieldValues.update	✔	✔	✔
chronicle.customFields.delete	✔		✔
chronicle.customFields.get	✔	✔	✔	✔
chronicle.customFields.update	✔		✔
chronicle.customLists.delete	✔		✔
chronicle.customLists.get	✔	✔	✔
chronicle.customLists.update	✔		✔
chronicle.dashboardCharts.get	✔	✔		✔	✔	✔
chronicle.dashboardCharts.list	✔	✔		✔	✔	✔
chronicle.dashboardQueries.execute	✔	✔		✔	✔	✔
chronicle.dashboardQueries.get	✔	✔		✔	✔	✔
chronicle.dashboardQueries.list	✔	✔		✔	✔	✔
chronicle.dashboardScheduledReports.create	✔	✔
chronicle.dashboardScheduledReports.delete	✔	✔
chronicle.dashboardScheduledReports.duplicate	✔	✔
chronicle.dashboardScheduledReports.fetchHistory	✔	✔		✔
chronicle.dashboardScheduledReports.get	✔	✔		✔
chronicle.dashboardScheduledReports.list	✔	✔		✔
chronicle.dashboardScheduledReports.trigger	✔	✔
chronicle.dashboardScheduledReports.update	✔	✔
chronicle.dashboards.copy	✔	✔					✔
chronicle.dashboards.create	✔	✔					✔
chronicle.dashboards.delete	✔	✔
chronicle.dashboards.edit	✔	✔
chronicle.dashboards.get	✔	✔		✔	✔		✔
chronicle.dashboards.list	✔	✔		✔	✔		✔
chronicle.dashboards.schedule	✔	✔		✔	✔
chronicle.dataAccessLabels.create	✔
chronicle.dataAccessLabels.delete	✔
chronicle.dataAccessLabels.get	✔
chronicle.dataAccessLabels.list	✔
chronicle.dataAccessLabels.update	✔
chronicle.dataAccessScopes.create	✔
chronicle.dataAccessScopes.delete	✔
chronicle.dataAccessScopes.get	✔
chronicle.dataAccessScopes.list	✔	✔	✔	✔	✔	✔
chronicle.dataAccessScopes.permit	✔															✔
chronicle.dataAccessScopes.update	✔
chronicle.dataExports.cancel	✔	✔
chronicle.dataExports.create	✔	✔
chronicle.dataExports.fetchLogTypesAvailableForExport	✔	✔		✔
chronicle.dataExports.fetchServiceAccountForDataExport	✔	✔		✔
chronicle.dataExports.get	✔	✔		✔
chronicle.dataExports.list	✔	✔		✔
chronicle.dataExports.update	✔	✔
chronicle.dataTableOperationErrors.get	✔	✔		✔
chronicle.dataTableRows.asyncBulkAppend	✔	✔
chronicle.dataTableRows.asyncBulkCreate	✔	✔
chronicle.dataTableRows.asyncBulkDelete	✔	✔
chronicle.dataTableRows.asyncBulkReplace	✔	✔
chronicle.dataTableRows.asyncBulkUpdate	✔	✔
chronicle.dataTableRows.bulkCreate	✔	✔					✔
chronicle.dataTableRows.bulkDelete	✔	✔
chronicle.dataTableRows.bulkGet	✔	✔		✔		✔
chronicle.dataTableRows.bulkReplace	✔	✔
chronicle.dataTableRows.bulkUpdate	✔	✔
chronicle.dataTableRows.create	✔	✔
chronicle.dataTableRows.delete	✔	✔					✔
chronicle.dataTableRows.get	✔	✔		✔		✔
chronicle.dataTableRows.list	✔	✔		✔		✔	✔
chronicle.dataTableRows.update	✔	✔
chronicle.dataTables.bulkCreateDataTableAsync	✔	✔
chronicle.dataTables.create	✔	✔
chronicle.dataTables.delete	✔	✔
chronicle.dataTables.get	✔	✔		✔		✔	✔
chronicle.dataTables.list	✔	✔		✔		✔	✔
chronicle.dataTables.update	✔	✔
chronicle.dataTaps.create	✔	✔
chronicle.dataTaps.delete	✔	✔
chronicle.dataTaps.get	✔	✔		✔
chronicle.dataTaps.list	✔	✔		✔
chronicle.dataTaps.update	✔	✔
chronicle.emailTemplates.delete	✔		✔
chronicle.emailTemplates.get	✔	✔	✔
chronicle.emailTemplates.update	✔		✔
chronicle.enrichmentCombination.get	✔	✔		✔	✔	✔
chronicle.enrichmentControls.create	✔	✔
chronicle.enrichmentControls.delete	✔
chronicle.enrichmentControls.disable	✔	✔
chronicle.enrichmentControls.get	✔	✔		✔	✔	✔
chronicle.enrichmentControls.list	✔	✔		✔	✔	✔
chronicle.entities.batchCreate	✔	✔
chronicle.entities.batchDelete	✔	✔
chronicle.entities.batchValidate	✔	✔
chronicle.entities.create	✔	✔
chronicle.entities.delete	✔	✔
chronicle.entities.find	✔	✔		✔	✔	✔
chronicle.entities.findEntityAlerts	✔	✔		✔	✔	✔
chronicle.entities.findRelatedEntities	✔	✔		✔	✔	✔	✔
chronicle.entities.get	✔	✔		✔	✔	✔
chronicle.entities.import	✔	✔
chronicle.entities.list	✔	✔		✔		✔
chronicle.entities.modifyEntityRiskScore	✔	✔
chronicle.entities.queryEntityRiskScoreModifications	✔	✔		✔	✔
chronicle.entities.searchEntities	✔	✔		✔	✔	✔
chronicle.entities.summarize	✔	✔		✔	✔	✔	✔
chronicle.entities.summarizeFromQuery	✔	✔		✔	✔	✔	✔
chronicle.entitiesBlocklists.delete	✔		✔
chronicle.entitiesBlocklists.get	✔	✔	✔
chronicle.entitiesBlocklists.update	✔		✔
chronicle.entityRiskScores.queryEntityRiskScores	✔	✔		✔	✔
chronicle.environmentGroups.delete	✔		✔
chronicle.environmentGroups.get	✔	✔	✔	✔
chronicle.environmentGroups.update	✔		✔
chronicle.environments.delete	✔		✔
chronicle.environments.get	✔	✔	✔	✔
chronicle.environments.update	✔		✔
chronicle.events.batchGet	✔	✔		✔	✔	✔
chronicle.events.fetchEnrichedEvent	✔	✔		✔	✔	✔
chronicle.events.findUdmFieldValues	✔	✔		✔	✔	✔
chronicle.events.get	✔	✔		✔	✔	✔
chronicle.events.import	✔	✔
chronicle.events.queryProductSourceStats	✔	✔		✔	✔	✔
chronicle.events.searchRawLogs	✔	✔		✔	✔	✔
chronicle.events.udmSearch	✔	✔		✔	✔	✔	✔
chronicle.events.validateQuery	✔	✔		✔	✔	✔
chronicle.extensionValidationReports.get	✔
chronicle.extensionValidationReports.list	✔
chronicle.featuredContentNativeDashboards.get	✔	✔		✔	✔	✔
chronicle.featuredContentNativeDashboards.install	✔	✔
chronicle.featuredContentNativeDashboards.list	✔	✔		✔	✔	✔
chronicle.featuredContentRules.list	✔	✔		✔
chronicle.featuredContentSearchQueries.get	✔	✔		✔	✔	✔
chronicle.featuredContentSearchQueries.install	✔	✔
chronicle.featuredContentSearchQueries.list	✔	✔		✔	✔	✔
chronicle.federationGroups.create											✔
chronicle.federationGroups.delete											✔
chronicle.federationGroups.get											✔		✔
chronicle.federationGroups.list											✔		✔
chronicle.federationGroups.update											✔
chronicle.feedPacks.get	✔	✔		✔
chronicle.feedPacks.list	✔	✔		✔
chronicle.feedServiceAccounts.fetch	✔
chronicle.feedSourceTypeSchemas.list	✔
chronicle.feeds.create	✔
chronicle.feeds.delete	✔
chronicle.feeds.disable	✔
chronicle.feeds.enable	✔
chronicle.feeds.generateSecret	✔
chronicle.feeds.get	✔
chronicle.feeds.list	✔
chronicle.feeds.update	✔
chronicle.findingsGraphs.exploreNode	✔	✔		✔	✔	✔
chronicle.findingsGraphs.initializeGraph	✔	✔		✔	✔	✔
chronicle.findingsRefinementDeployments.get	✔	✔		✔	✔
chronicle.findingsRefinementDeployments.list	✔	✔		✔	✔
chronicle.findingsRefinementDeployments.update	✔	✔
chronicle.findingsRefinements.computeActivity	✔	✔		✔	✔
chronicle.findingsRefinements.computeAllActivities	✔	✔		✔	✔
chronicle.findingsRefinements.create	✔	✔
chronicle.findingsRefinements.get	✔	✔		✔	✔
chronicle.findingsRefinements.list	✔	✔		✔	✔
chronicle.findingsRefinements.test	✔	✔		✔	✔
chronicle.findingsRefinements.update	✔	✔
chronicle.formDynamicParameters.get	✔	✔	✔	✔
chronicle.formDynamicParameters.update	✔		✔
chronicle.forwarders.create	✔
chronicle.forwarders.delete	✔
chronicle.forwarders.generate	✔	✔		✔
chronicle.forwarders.get	✔	✔		✔
chronicle.forwarders.importStatsEvents	✔	✔
chronicle.forwarders.list	✔	✔		✔
chronicle.forwarders.update	✔
chronicle.globalDataAccessScopes.permit	✔	✔		✔	✔		✔								✔
chronicle.ingestionLogLabels.get	✔	✔		✔	✔
chronicle.ingestionLogLabels.list	✔	✔		✔	✔
chronicle.ingestionLogNamespaces.get	✔	✔		✔	✔
chronicle.ingestionLogNamespaces.list	✔	✔		✔	✔
chronicle.instances.delete														✔
chronicle.instances.generateCollectionAgentAuth	✔	✔		✔		✔
chronicle.instances.generateSoarAuthJwt	✔	✔	✔	✔		✔
chronicle.instances.generateWorkspaceConnectionToken	✔
chronicle.instances.get	✔	✔	✔	✔	✔	✔	✔
chronicle.instances.graduatePocInstance	✔
chronicle.instances.logTypeClassifier	✔	✔		✔
chronicle.instances.permitFederationAccess											✔		✔
chronicle.instances.report	✔	✔		✔		✔
chronicle.instances.runThreatHunt	✔	✔
chronicle.instances.soarAdmin	✔		✔
chronicle.instances.soarThreatManager									✔
chronicle.instances.soarVulnerabilityManager										✔
chronicle.instances.undelete														✔
chronicle.instances.update	✔
chronicle.instances.verifyNonce	✔
chronicle.integrationActionRevisions.delete	✔	✔	✔
chronicle.integrationActionRevisions.get	✔	✔	✔
chronicle.integrationActionRevisions.update	✔	✔	✔
chronicle.integrationActions.delete	✔		✔
chronicle.integrationActions.get	✔	✔	✔	✔
chronicle.integrationActions.run	✔	✔	✔
chronicle.integrationActions.update	✔	✔	✔
chronicle.integrationInstances.delete	✔	✔	✔
chronicle.integrationInstances.get	✔	✔	✔
chronicle.integrationInstances.update	✔	✔	✔
chronicle.integrationLogicalOperatorRevisions.delete	✔	✔	✔
chronicle.integrationLogicalOperatorRevisions.get	✔	✔	✔
chronicle.integrationLogicalOperatorRevisions.update	✔	✔	✔
chronicle.integrationLogicalOperators.delete	✔	✔	✔
chronicle.integrationLogicalOperators.execute	✔	✔	✔
chronicle.integrationLogicalOperators.get	✔	✔	✔
chronicle.integrationLogicalOperators.update	✔	✔	✔
chronicle.integrations.delete	✔		✔
chronicle.integrations.get	✔	✔	✔	✔
chronicle.integrations.update	✔	✔	✔
chronicle.investigationComments.create	✔	✔
chronicle.investigationComments.delete	✔	✔
chronicle.investigationComments.get	✔	✔		✔	✔
chronicle.investigationComments.list	✔	✔		✔	✔
chronicle.investigationComments.update	✔	✔
chronicle.investigationSteps.get	✔	✔		✔	✔
chronicle.investigationSteps.list	✔	✔		✔	✔
chronicle.investigations.fetchAssociated	✔	✔		✔
chronicle.investigations.get	✔	✔		✔			✔
chronicle.investigations.list	✔	✔		✔			✔
chronicle.investigations.trigger	✔	✔					✔
chronicle.involvedEntities.get	✔	✔	✔	✔
chronicle.involvedEntities.update	✔	✔	✔
chronicle.iocAssociations.batchGet	✔	✔		✔	✔
chronicle.iocAssociations.fetchRelated	✔	✔		✔	✔
chronicle.iocAssociations.get	✔	✔		✔	✔
chronicle.iocMatches.get	✔	✔		✔
chronicle.iocMatches.list	✔	✔		✔
chronicle.iocState.get	✔	✔		✔
chronicle.iocState.update	✔	✔
chronicle.iocs.batchGet	✔	✔		✔
chronicle.iocs.fetchRelated	✔	✔		✔	✔
chronicle.iocs.findFirstAndLastSeen	✔	✔		✔
chronicle.iocs.findIocs	✔	✔		✔	✔
chronicle.iocs.get	✔	✔		✔
chronicle.iocs.searchCuratedDetectionsForIoc	✔	✔		✔
chronicle.jobInstanceLogs.get	✔	✔	✔
chronicle.jobInstances.delete	✔	✔	✔
chronicle.jobInstances.get	✔	✔	✔
chronicle.jobInstances.run	✔	✔	✔
chronicle.jobInstances.update	✔	✔	✔
chronicle.jobRevisions.delete	✔	✔	✔
chronicle.jobRevisions.get	✔	✔	✔
chronicle.jobRevisions.update	✔	✔	✔
chronicle.jobs.delete	✔		✔
chronicle.jobs.get	✔	✔	✔
chronicle.jobs.update	✔	✔	✔
chronicle.labsExperimentExecutions.get	✔	✔		✔
chronicle.labsExperimentExecutions.list	✔	✔		✔
chronicle.labsExperimentExecutions.update	✔	✔
chronicle.labsExperiments.execute	✔	✔
chronicle.labsExperiments.get	✔	✔		✔
chronicle.labsExperiments.list	✔	✔		✔
chronicle.labsExperiments.update	✔	✔
chronicle.legacies.legacyBatchGetCases	✔	✔		✔	✔	✔
chronicle.legacies.legacyBatchGetCollections	✔	✔		✔	✔	✔
chronicle.legacies.legacyFetchAlertsView	✔	✔		✔	✔	✔
chronicle.legacies.legacyFetchUdmSearchCsv	✔	✔		✔	✔	✔
chronicle.legacies.legacyFetchUdmSearchView	✔	✔		✔	✔	✔
chronicle.legacies.legacyFindAssetEvents	✔	✔		✔	✔	✔
chronicle.legacies.legacyFindRawLogs	✔	✔		✔	✔	✔
chronicle.legacies.legacyFindUdmEvents	✔	✔		✔	✔	✔
chronicle.legacies.legacyGetAlert	✔	✔		✔	✔	✔
chronicle.legacies.legacyGetCuratedRulesTrends	✔	✔		✔
chronicle.legacies.legacyGetDetection	✔	✔		✔			✔
chronicle.legacies.legacyGetEventForDetection	✔	✔		✔
chronicle.legacies.legacyGetRuleCounts	✔	✔		✔		✔
chronicle.legacies.legacyGetRulesTrends	✔	✔		✔		✔
chronicle.legacies.legacyRunTestRule	✔	✔		✔		✔
chronicle.legacies.legacySearchArtifactEvents	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchArtifactIoCDetails	✔	✔		✔	✔	✔	✔
chronicle.legacies.legacySearchAssetEvents	✔	✔		✔	✔	✔	✔
chronicle.legacies.legacySearchCuratedDetections	✔	✔		✔			✔
chronicle.legacies.legacySearchCustomerStats	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchDetections	✔	✔		✔			✔
chronicle.legacies.legacySearchDomainsRecentlyRegistered	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchDomainsTimingStats	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchEnterpriseWideAlerts	✔	✔		✔	✔
chronicle.legacies.legacySearchEnterpriseWideIoCs	✔	✔		✔	✔		✔
chronicle.legacies.legacySearchFindings	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchIngestionStats	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchIoCInsights	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchRawLogs	✔	✔		✔	✔	✔
chronicle.legacies.legacySearchRuleDetectionCountBuckets	✔	✔		✔		✔
chronicle.legacies.legacySearchRuleDetectionEvents	✔	✔		✔		✔
chronicle.legacies.legacySearchRuleResults	✔	✔		✔		✔
chronicle.legacies.legacySearchRulesAlerts	✔	✔		✔		✔
chronicle.legacies.legacySearchUserEvents	✔	✔		✔	✔	✔
chronicle.legacies.legacyStreamDetectionAlerts	✔	✔		✔			✔
chronicle.legacies.legacyTestRuleStreaming	✔	✔		✔
chronicle.legacies.legacyUpdateAlert	✔	✔					✔
chronicle.legacyCaseFederationPlatforms.delete	✔		✔
chronicle.legacyCaseFederationPlatforms.get	✔		✔
chronicle.legacyCaseFederationPlatforms.update	✔		✔
chronicle.legacyCases.createManual	✔	✔	✔
chronicle.legacyCases.createSimulated	✔	✔	✔
chronicle.legacyCases.deleteSimulated	✔	✔	✔
chronicle.legacyCases.exportJson	✔	✔	✔
chronicle.legacyCases.get	✔	✔	✔	✔
chronicle.legacyCases.getSimulated	✔	✔	✔
chronicle.legacyCases.importJson	✔	✔	✔
chronicle.legacyCases.ingest	✔	✔	✔
chronicle.legacyCases.ingestAlertTestCase	✔	✔	✔
chronicle.legacyCases.runManualAction	✔	✔	✔
chronicle.legacyCases.simulate	✔	✔	✔
chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration	✔		✔
chronicle.legacyFederatedCases.batchPatchFederatedCases	✔		✔
chronicle.legacyFederatedCases.fetchCasesToSync	✔		✔
chronicle.legacyFederatedCases.get	✔		✔
chronicle.legacyPlaybooks.delete	✔	✔	✔
chronicle.legacyPlaybooks.export	✔	✔	✔
chronicle.legacyPlaybooks.get	✔	✔	✔
chronicle.legacyPlaybooks.import	✔	✔	✔
chronicle.legacyPlaybooks.update	✔	✔	✔
chronicle.legacyPublisher.get	✔		✔									✔
chronicle.legacyPublisher.update	✔		✔									✔
chronicle.legacySdk.get	✔		✔				✔					✔
chronicle.legacySdk.update	✔		✔				✔					✔
chronicle.legacySearches.searchCases	✔	✔	✔	✔
chronicle.legacySearches.searchEntities	✔	✔	✔	✔
chronicle.legacySoarAdvancedReports.delete	✔	✔	✔
chronicle.legacySoarAdvancedReports.get	✔	✔	✔	✔
chronicle.legacySoarAdvancedReports.share	✔	✔	✔
chronicle.legacySoarAdvancedReports.update	✔	✔	✔
chronicle.legacySoarAudits.legacySoarAudit	✔		✔
chronicle.legacySoarDashboards.delete	✔	✔	✔
chronicle.legacySoarDashboards.get	✔	✔	✔	✔
chronicle.legacySoarDashboards.update	✔	✔	✔
chronicle.legacySoarIdpMappingGroups.delete	✔		✔
chronicle.legacySoarIdpMappingGroups.get	✔		✔
chronicle.legacySoarIdpMappingGroups.update	✔		✔
chronicle.legacySoarPermissionGroups.get	✔		✔
chronicle.legacySoarReports.delete	✔	✔	✔
chronicle.legacySoarReports.get	✔	✔	✔	✔
chronicle.legacySoarReports.update	✔	✔	✔
chronicle.legacySoarSettings.get	✔	✔	✔	✔
chronicle.legacySoarSettings.update	✔		✔
chronicle.legacySoarUsers.delete	✔		✔
chronicle.legacySoarUsers.get	✔	✔	✔	✔
chronicle.legacySystem.getLicenseStatus	✔		✔
chronicle.legacySystem.getMaximumDataRetentionValue	✔		✔
chronicle.legacySystem.getSystemVersion	✔		✔
chronicle.legacySystemMetadata.get	✔	✔	✔	✔
chronicle.legacySystemMetadata.placeholders	✔		✔
chronicle.logProcessingPipelines.associateStreams	✔
chronicle.logProcessingPipelines.create	✔
chronicle.logProcessingPipelines.delete	✔
chronicle.logProcessingPipelines.dissociateStreams	✔
chronicle.logProcessingPipelines.fetchAssociatedPipeline	✔	✔		✔
chronicle.logProcessingPipelines.fetchSampleLogsByStreams	✔	✔		✔
chronicle.logProcessingPipelines.get	✔	✔		✔
chronicle.logProcessingPipelines.list	✔	✔		✔
chronicle.logProcessingPipelines.testPipeline	✔	✔		✔
chronicle.logProcessingPipelines.update	✔
chronicle.logTypeSchemas.list	✔	✔		✔	✔
chronicle.logTypeSettings.get	✔
chronicle.logTypeSettings.list	✔
chronicle.logTypeSettings.update	✔
chronicle.logTypes.create	✔
chronicle.logTypes.get	✔
chronicle.logTypes.list	✔
chronicle.logTypes.update	✔
chronicle.logs.export	✔	✔		✔	✔
chronicle.logs.get	✔	✔		✔	✔	✔
chronicle.logs.import	✔	✔
chronicle.logs.list	✔	✔		✔	✔	✔
chronicle.managedDomainSettings.get	✔	✔		✔
chronicle.managedDomainSettings.update	✔
chronicle.managerRevisions.delete	✔	✔	✔
chronicle.managerRevisions.get	✔	✔	✔
chronicle.managerRevisions.update	✔	✔	✔
chronicle.managers.delete	✔	✔	✔
chronicle.managers.get	✔	✔	✔
chronicle.managers.update	✔	✔	✔
chronicle.mappingRules.delete	✔		✔
chronicle.mappingRules.get	✔		✔
chronicle.mappingRules.update	✔		✔
chronicle.marketplaceIntegrations.get	✔	✔	✔	✔
chronicle.marketplaceIntegrations.install	✔	✔	✔
chronicle.marketplaceIntegrations.uninstall	✔	✔	✔
chronicle.messages.create	✔	✔					✔
chronicle.messages.delete	✔	✔					✔
chronicle.messages.get	✔	✔		✔	✔
chronicle.messages.list	✔	✔		✔	✔
chronicle.messages.update	✔	✔
chronicle.moduleSettings.get	✔	✔	✔	✔
chronicle.moduleSettings.rebranding	✔	✔	✔	✔
chronicle.moduleSettingsProperties.get	✔		✔
chronicle.moduleSettingsProperties.testSettings	✔		✔
chronicle.moduleSettingsProperties.update	✔		✔
chronicle.multitenantDirectories.get	✔	✔		✔	✔	✔
chronicle.nativeDashboards.create	✔	✔
chronicle.nativeDashboards.delete	✔	✔
chronicle.nativeDashboards.duplicate	✔	✔
chronicle.nativeDashboards.get	✔	✔		✔	✔	✔
chronicle.nativeDashboards.list	✔	✔		✔	✔	✔
chronicle.nativeDashboards.update	✔	✔
chronicle.notebooks.get	✔	✔		✔	✔
chronicle.notebooks.list	✔	✔		✔	✔
chronicle.notificationSettings.get	✔	✔	✔
chronicle.notificationSettings.update	✔	✔	✔
chronicle.ontologyRecords.get	✔	✔	✔
chronicle.ontologyRecords.update	✔		✔
chronicle.operations.cancel	✔	✔
chronicle.operations.delete	✔	✔
chronicle.operations.get	✔	✔		✔	✔	✔
chronicle.operations.list	✔	✔		✔	✔	✔
chronicle.operations.streamSearch	✔	✔		✔	✔	✔
chronicle.operations.wait	✔	✔		✔	✔	✔
chronicle.parserExtensions.activate	✔
chronicle.parserExtensions.create	✔
chronicle.parserExtensions.delete	✔
chronicle.parserExtensions.generateKeyValueMappings	✔
chronicle.parserExtensions.get	✔
chronicle.parserExtensions.legacySubmitParserExtension	✔
chronicle.parserExtensions.list	✔
chronicle.parserExtensions.removeSyslog	✔
chronicle.parsers.activate	✔
chronicle.parsers.activateReleaseCandidate	✔
chronicle.parsers.copyPrebuiltParser	✔
chronicle.parsers.create	✔
chronicle.parsers.deactivate	✔
chronicle.parsers.delete	✔
chronicle.parsers.generateEventTypesSuggestions	✔
chronicle.parsers.get	✔
chronicle.parsers.list	✔
chronicle.parsers.runParser	✔
chronicle.parsers.update	✔
chronicle.parsingErrors.list	✔
chronicle.preferenceSets.get	✔	✔	✔	✔	✔	✔
chronicle.preferenceSets.update	✔	✔		✔	✔	✔	✔
chronicle.propertySchemaDefinitions.delete	✔		✔
chronicle.propertySchemaDefinitions.get	✔		✔
chronicle.propertySchemaDefinitions.update	✔		✔
chronicle.queries.suggestSql	✔	✔		✔	✔	✔
chronicle.referenceLists.create	✔	✔
chronicle.referenceLists.get	✔	✔		✔		✔	✔
chronicle.referenceLists.list	✔	✔		✔		✔	✔
chronicle.referenceLists.update	✔	✔					✔
chronicle.referenceLists.verifyReferenceList	✔	✔		✔		✔
chronicle.remoteAgents.delete	✔	✔	✔
chronicle.remoteAgents.get	✔	✔	✔
chronicle.remoteAgents.update	✔	✔	✔
chronicle.requestTemplates.delete	✔		✔
chronicle.requestTemplates.get	✔	✔	✔	✔
chronicle.requestTemplates.update	✔		✔
chronicle.retrohunts.create	✔	✔					✔
chronicle.retrohunts.get	✔	✔		✔		✔
chronicle.retrohunts.list	✔	✔		✔		✔
chronicle.riskConfigs.get	✔	✔		✔
chronicle.riskConfigs.update	✔	✔
chronicle.ruleDeployments.get	✔	✔		✔		✔
chronicle.ruleDeployments.list	✔	✔		✔		✔
chronicle.ruleDeployments.update	✔	✔
chronicle.ruleExecutionErrors.list	✔	✔		✔		✔
chronicle.rules.create	✔	✔
chronicle.rules.delete	✔
chronicle.rules.get	✔	✔		✔		✔	✔
chronicle.rules.list	✔	✔		✔		✔
chronicle.rules.listRevisions	✔	✔		✔		✔
chronicle.rules.modifyRules	✔	✔
chronicle.rules.update	✔	✔
chronicle.rules.verifyRuleText	✔	✔		✔		✔
chronicle.savedColumnSets.create	✔	✔		✔
chronicle.savedColumnSets.delete	✔	✔		✔
chronicle.savedColumnSets.get	✔	✔		✔
chronicle.savedColumnSets.list	✔	✔		✔
chronicle.savedColumnSets.update	✔	✔		✔
chronicle.searchQueries.create	✔	✔		✔	✔	✔
chronicle.searchQueries.delete	✔	✔		✔	✔	✔
chronicle.searchQueries.get	✔	✔		✔	✔	✔
chronicle.searchQueries.list	✔	✔		✔	✔	✔
chronicle.searchQueries.update	✔	✔		✔	✔	✔
chronicle.searchSessions.search	✔	✔		✔	✔	✔
chronicle.searchedResults.list	✔	✔		✔	✔	✔
chronicle.shareConfigs.get	✔
chronicle.shareConfigs.update	✔
chronicle.slaDefinitions.delete	✔		✔
chronicle.slaDefinitions.get	✔		✔
chronicle.slaDefinitions.update	✔		✔
chronicle.soarDomains.delete	✔		✔
chronicle.soarDomains.get	✔	✔	✔
chronicle.soarDomains.update	✔		✔
chronicle.soarNetworks.delete	✔		✔
chronicle.soarNetworks.get	✔	✔	✔
chronicle.soarNetworks.update	✔		✔
chronicle.socRoles.delete	✔		✔
chronicle.socRoles.get	✔	✔	✔	✔
chronicle.socRoles.update	✔		✔
chronicle.summaryTables.create	✔	✔
chronicle.summaryTables.delete	✔	✔
chronicle.summaryTables.get	✔	✔		✔		✔
chronicle.summaryTables.list	✔	✔		✔		✔
chronicle.summaryTables.update	✔	✔
chronicle.systemNotifications.get	✔		✔
chronicle.systemNotifications.update	✔		✔
chronicle.tasks.delete	✔	✔	✔
chronicle.tasks.get	✔	✔	✔
chronicle.tasks.update	✔	✔	✔
chronicle.tenants.create	✔
chronicle.tenants.list	✔
chronicle.tenants.update	✔
chronicle.threatCollectionFilterSet.get	✔	✔		✔	✔
chronicle.threatCollections.fetchEntityMetadata	✔	✔		✔	✔
chronicle.threatCollections.fetchIocMatchMetadata	✔	✔		✔	✔
chronicle.threatCollections.fetchRelated	✔	✔		✔	✔
chronicle.threatCollections.get	✔	✔		✔	✔
chronicle.threatCollections.list	✔	✔		✔	✔
chronicle.transformerDefinitions.create	✔	✔	✔
chronicle.transformerDefinitions.delete	✔	✔	✔
chronicle.transformerDefinitions.execute	✔	✔	✔
chronicle.transformerDefinitions.get	✔	✔	✔
chronicle.transformerDefinitions.list	✔	✔	✔
chronicle.transformerDefinitions.update	✔	✔	✔
chronicle.transformerRevisions.delete	✔	✔	✔
chronicle.transformerRevisions.get	✔	✔	✔
chronicle.transformerRevisions.update	✔	✔	✔
chronicle.uniqueEntities.get	✔	✔	✔
chronicle.uniqueEntities.update	✔	✔	✔
chronicle.userLocalizations.get	✔	✔	✔
chronicle.userLocalizations.update	✔	✔	✔
chronicle.userNotifications.get	✔	✔	✔
chronicle.userNotifications.update	✔	✔	✔
chronicle.validationErrors.list	✔
chronicle.validationReports.get	✔
chronicle.views.get	✔		✔
chronicle.views.update	✔		✔
chronicle.visualFamilies.delete	✔		✔
chronicle.visualFamilies.get	✔	✔	✔
chronicle.visualFamilies.update	✔		✔
chronicle.watchlists.create	✔	✔
chronicle.watchlists.delete	✔	✔
chronicle.watchlists.get	✔	✔		✔
chronicle.watchlists.list	✔	✔		✔
chronicle.watchlists.update	✔	✔
chronicle.webhooks.delete	✔	✔	✔
chronicle.webhooks.get	✔	✔	✔
chronicle.webhooks.update	✔	✔	✔
chronicle.workdeskContacts.delete	✔	✔	✔
chronicle.workdeskContacts.get	✔	✔	✔
chronicle.workdeskContacts.update	✔	✔	✔
chronicle.workdeskLinks.delete	✔	✔	✔
chronicle.workdeskLinks.get	✔	✔	✔
chronicle.workdeskLinks.update	✔	✔	✔
chronicle.workdeskNotes.delete	✔	✔	✔
chronicle.workdeskNotes.get	✔	✔	✔
chronicle.workdeskNotes.update	✔	✔	✔
cloudasset.assets.analyzeIamPolicy								✔
cloudasset.assets.exportIamPolicy								✔
cloudasset.assets.exportResource	✔		✔					✔	✔	✔
cloudasset.assets.queryAccessPolicy	✔		✔						✔	✔
cloudasset.assets.queryIamPolicy	✔		✔						✔	✔
cloudasset.assets.queryOSInventories	✔		✔						✔	✔
cloudasset.assets.queryResource	✔		✔						✔	✔
cloudasset.assets.searchAllIamPolicies	✔		✔					✔	✔	✔
cloudasset.assets.searchAllResources	✔		✔					✔	✔	✔
cloudasset.assets.searchEnrichmentResourceOwners	✔		✔						✔	✔
compute.firewalls.get								✔
compute.firewalls.update								✔
compute.globalOperations.get								✔
compute.instances.deleteAccessConfig								✔
compute.instances.get								✔
compute.instances.list								✔
compute.instances.stop								✔
compute.instances.updateNetworkInterface								✔
compute.networks.updatePolicy								✔
compute.regionOperations.get								✔
compute.zoneOperations.get								✔
compute.zones.list								✔
iam.serviceAccounts.disable								✔
iam.serviceAccounts.list								✔
logging.logEntries.create							✔
logging.logEntries.route							✔
mcp.tools.call							✔
monitoring.alertPolicies.create							✔
monitoring.alertPolicies.delete							✔
monitoring.alertPolicies.get							✔
monitoring.alertPolicies.list							✔
monitoring.alertPolicies.update							✔
recommender.iamPolicyRecommendations.get								✔
recommender.iamPolicyRecommendations.list								✔
recommender.iamPolicyRecommendations.update								✔
resourcemanager.organizations.get	✔		✔						✔	✔
resourcemanager.organizations.getIamPolicy								✔
resourcemanager.projects.get	✔	✔	✔	✔	✔	✔	✔		✔	✔	✔	✔	✔	✔
resourcemanager.projects.list	✔	✔	✔	✔	✔	✔			✔	✔	✔	✔	✔	✔
securitycenter.attackpaths.list	✔		✔						✔	✔
securitycenter.exposurepathexplan.get	✔		✔						✔	✔
securitycenter.findingexternalsystems.update								✔
securitycenter.findings.bulkMuteUpdate	✔		✔						✔	✔
securitycenter.findings.group	✔		✔						✔	✔
securitycenter.findings.list	✔		✔					✔	✔	✔
securitycenter.findings.listFindingPropertyNames	✔		✔						✔	✔
securitycenter.findings.setMute	✔		✔					✔	✔	✔
securitycenter.findings.setState	✔		✔					✔	✔	✔
securitycenter.findings.update	✔		✔					✔	✔	✔
securitycenter.findingsecuritymarks.update	✔		✔						✔	✔
securitycenter.notificationconfig.create								✔
securitycenter.notificationconfig.delete								✔
securitycenter.notificationconfig.get								✔
securitycenter.notificationconfig.update								✔
securitycenter.simulations.get	✔		✔						✔	✔
securitycenter.sources.list								✔
securitycenter.userinterfacemetadata.get	✔		✔						✔	✔
securitycenter.valuedresources.list	✔		✔						✔	✔
serviceusage.operations.get							✔
serviceusage.quotas.get							✔
serviceusage.services.enable							✔
serviceusage.services.get							✔
serviceusage.services.list							✔
storage.buckets.create							✔
storage.buckets.get							✔	✔
storage.buckets.getIamPolicy							✔	✔
storage.buckets.list								✔
storage.buckets.setIamPolicy							✔
storage.buckets.update								✔
storage.objects.create							✔
storage.objects.delete							✔
storage.objects.get							✔
storage.objects.list							✔