What is data RBAC, and how does it affect search results?

Data RBAC (role-based access control) restricts which ingested data a given user can see in search results and dashboards based on their assigned scopes, letting an organization segment access to sensitive telemetry by team, business unit, or data sensitivity level rather than giving every platform user unrestricted visibility into all ingested data.

When data RBAC is enabled, a search or detection rule effectively only operates over the subset of data the requesting user's scopes permit, even if the underlying query itself doesn't explicitly reference any access-control logic — the restriction is enforced transparently based on the user's identity and assigned permissions, not something the analyst has to account for in how they write their query.

This matters for organizations with genuine internal segmentation needs — a managed security service provider handling multiple separate customers' data in one platform instance, or a large enterprise wanting to restrict a specific business unit's sensitive telemetry to only that unit's own analysts — where unrestricted, platform-wide visibility for every user would be an unacceptable access control gap.