Minimum permissions for running the SIEM agent

Products

• CASB Gateway Advanced

Issue/Introduction

When running the SIEM agent with minimal permissions the following error occurs: 

Log_Exporter_Client-ERROR-Response code of request is 403, Exiting!

Cause

The export permission was missing.

Resolution

The following permissions are necessary in an Access profile for running the SIEM agent:

For the Admin to download the logs from SIEM, the required min permission in Access Profile are:

• Permitted Apps
  • Investigate: View, Export
• Information Levels
  • Investigate: All
• Global Settings
  • API keys: modify
  • SIEM: view