> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-a-configuration-rule-for-serverless-functions.md).

# Create a configuration rule for serverless functions

Create Cortex Cloud Posture Management rules that detect serverless function configuration risks.

Config rules for serverless functions identify security misconfigurations within the settings and deployment infrastructure of your individual serverless resources.

1. Under **Posture Management**, select **Rules & Policies** → **Cloud Security (under Rules)** → **click Create Rule**.
2. Select **Config**.
3. On the **Overview** step of the **Create Config Rule** wizard.
   1. Fill in these fields:
      * **Rule Name**: (required): A user-provided to identify the rule
      * **Description** (required): A description of the rule
      * **Severity** (required): Select the severity level. Only findings with this exact severity level will trigger this rule. Findings with different severity levels will be ignored
      * **Labels**: (optional): Assign labels to categorize and organize the rule based on specific criteria or attributes. Labels help in easily identifying and filtering rules
      * **Enable How to Fix**: (Default: ON): Enable to take action when the rule is violated
   2. Click Next.
4. Define the logic for the configuration rule on the **Rule Logic** step of the wizard in the query editor.
   1. Under the **Value** menu in the **Find** field:
      1. Select **Compute**.
      2. Select the relevant serverless function from the list that is displayed. Options: **Lambda Function**, **Google Cloud Function**, **Azure Cloud Function**.

         The JSON configuration file for the selected serverless function is displayed. Note that each type of serverless function has a unique configuration file and unique properties.
   2. Select a property or multiple properties of the serverless function configuration file and provide a value.
   3. Click Search.

      All assets matching the search criteria are displayed. This allows you to validate the rule's effectiveness on existing functions and provides valuable context for refining the rule's logic to accurately identify future functions.
   4. Click **Next** if you have enabled a fix in step 1a above, or **Done** if fix is disabled.
5. Define the fix in the **How to Fix** step (when enabled in step 1a above), and click Done.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-a-configuration-rule-for-serverless-functions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.