---
title: MISP user roles and permissions
description: Review the user roles that are required in the MISP integration for Security Operations integration.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/misp-user-roles-and-permissions.html
release: australia
topic_type: reference
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Getting started with MISP integration for Security Operations, MISP administration, MISP integration for Security Operations, Threat Intelligence integrations, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# MISP user roles and permissions

Review the user roles that are required in the MISP integration for Security Operations integration.

|MISP capability|Tagger|Tag editor|
|---------------|------|----------|
|Observable Enrichment \(Read-only\)|✓|✓|
|Sighting Search \(Read-only\)|✓|✓|

|MISP capability|Sighting creator|
|---------------|----------------|
|Report Sighting|✓|

|MISP capability|Tagger|Tag editor|
|---------------|------|----------|
|Edit Event/Attribute Tags|✓|✓|
|Edit Event/Attribute Galaxies|✓|✓|
|Edit Attribute Comments|✓|✓|
|Add New Attribute to event|✓|✓|
|Create Event in MISP|✓|✓|

**Parent Topic:**[Getting started with MISP integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-started-with-misp-integration-for-security-operations.md)