From 3946764b3834ea383132ee7968492f84ec93f175 Mon Sep 17 00:00:00 2001
From: alexmoraru7 <40365465+alexmoraru7@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:12:04 +0000
Subject: [PATCH] Update user permission details for Investigate

Clarified user access levels for Investigate features, specifying which roles have access to advanced intelligence features.
---
 src/content/docs/security-center/investigate/index.mdx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/content/docs/security-center/investigate/index.mdx b/src/content/docs/security-center/investigate/index.mdx
index 475ed1d01b8..e6e89ebb07a 100644
--- a/src/content/docs/security-center/investigate/index.mdx
+++ b/src/content/docs/security-center/investigate/index.mdx
@@ -7,7 +7,9 @@ sidebar:
 ---
 
 :::note[User permission]
-All users can access Investigate. This includes accessing URL scanning, and filter passive DNS range.
+Investigate is available to all users. Every user can view existing URL scanner reports and initiate new URL scans.
+
+However, advanced intelligence features, including searching for IP and domain intelligence and passive DNS records, are restricted to users with the following roles: Super Admin, Administrator, Brand Protection, Cloudforce One Admin.
 :::
 
 Investigate allows you to view a domain’s category, the IP it belongs to, and whether the category has changed before. You can also see which records it points to, including the country of origin and passive DNS records. After searching with Investigate, you will get an API curl to retrieve the same search results.