We have setup Data RBAC and provided "Chronicle API Restricted Data Access Viewer" and "Chronicle API Restricted Data Access" with required IAM conditions.

The expected controls are working as expected but the "Data Access Viewer" role has permissions which provides users to download collection agent config files and  see org details (which contains customer ID and project names) under Profile Section is SIEM Settings.

Removing instances.generateCollectionAgentAuth can limit access to Collection agents. What permissions should I remove to limit the user from not seeing org details (which contains customer ID and project names) under Profile Section is SIEM Settings.

We're planning to create a custom role with limited permissions.