> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md).

# Create a graph rule

{% hint style="success" %}
**Prerequisite**: Creating a graph rule requires View or View/Edit RBAC permissions for Graph Search under **Investigation & Response → Search**.
{% endhint %}

The Graph Engine is a Cortex detection method that identifies threats by analyzing relationships between entities rather than evaluating individual events in isolation.\
The engine periodically queries a contextual security graph that represents your environment as:

* Nodes, such as identities, configurations, code repositories, data stores, and cloud resources.
* Edges and paths, which represent the relationships and access routes between those entities.\
  Graph detection rules evaluate these relationships to identify risky combinations and potential attack paths. When a rule matches, the Graph Engine creates a live, evidence-backed issue in the Cortex issues experience.

Cortex includes predefined system Attack Path Graph rules. You can also create custom rules tailored to your organization’s environment and security requirements.

## Key characteristics

* **Detection type:** Graph-based detection that evaluates relationships and paths between entities.
* **Cyclic evaluation**: Graph rules run periodically rather than evaluating each event as it arrives. By default, the engine runs every 6 hours.
* **Path-based issue:** Each issue is uniquely identified by the rule ID and the graph path that triggered it. This allows the engine to track matching paths across evaluation cycles and automatically close issues generated by outdated rule versions.
* **Rule output**: The Graph Engine creates issues that appear in the Cortex issues experience.

## How to create a graph rule

To create a graph detection rule, navigate to **Posture Management → Rules & Policies → Rules → Cloud Security**.

1. Select **Create Rule → Graph**.
2. In the **New Graph Rule** page, under **General**, add the following details

* **Main Settings**:
  * **Name**: A unique name for the rule.
  * **Description**: A description of the rule.
  * **Labels** (optional): Add labels to the rule.
  * **Severity**: Select a severity level for the issue that will be triggered.
  * **Remediation** (optional): Define Remediation instructions.
* **Compliance Controls** (optional): Select a control from the controls catalog.

4. In the **Condition** page, select the relevant options to build your query. The core logic for an attack path rule is built by selecting a primary asset and attaching Finding or Vulnerability conditions to it. For more information about how to build your graph query, see [Create Graph Search query](broken://pages/p0GyuHIbtl11pimcTNKr). Use **Generate Preview** to see the results of your query.
5. In the **Summary** page, review the rule and click **Save**.

After the rule is synchronized and enabled, the Graph Engine evaluates it during the next scheduled cycle. An issue is created for each graph path that matches the rule conditions.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.