---
title: Required permissions
description: Managing events that could disrupt your organization's services requires a structured, collaborative approach. Coralogix's Investigations feature offers a comprehensive solution for teams to work together and plan mitigation strategies for such events. With this tool, you can consolidate all evidence in one place, visualize the sequence of events to understand cause and effect and collaborate seamlessly with colleagues to gather input and expertis
url: https://coralogix.com/docs/user-guides/investigations/required-permissions/
product: investigations
feature: Investigations Overview
feature_id: investigations-general
feature_identifier: investigations/investigations-general
last_updated: '2026-09-03'
---

# Required permissions

Users with the following permissions may create, view, and update investigations.

| Resource                   | Description                                                                                | System roles                                                                                 | API presets |
| -------------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | ----------- |
| `INVESTIGATIONS:READ`      | View investigations to which you've been invited or are public.                            | Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User | -           |
| `INVESTIGATIONS:UPDATE`    | Create and update investigations to which you've been invited or are public.               | Data Admin, Observability Lead, Platform Admin, Security User, Standard User                 | -           |
| `INVESTIGATIONS:READALL`   | View all private and public investigations without invitation.                             | Observability Lead, Platform Admin, Security User                                            | -           |
| `INVESTIGATIONS:UPDATEALL` | Create investigations and update all private and public investigations without invitation. | Observability Lead, Platform Admin, Security User                                            | -           |

## Next steps

Start your first investigation by following the steps in [Create an investigation](https://coralogix.com/docs/user-guides/investigations/create-an-investigation.md).