> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule.md). # Add an issue exclusion rule Through the process of triaging issues or resolving a case, you may determine that a specific issue does not indicate a threat. If you want Cortex Cloud to exclude the display of issues that match certain criteria, you can create an issue exclusion rule. After you create an exclusion rule, Cortex Cloud hides any future issues that match the criteria, and excludes the issues from cases and search query results. If you choose to apply the rule to historic results as well as future issues, the app marks any historic issues as unavailable. {% hint style="info" %} ### Note If a case only contains issues with exclusions, Cortex Cloud changes the case status to **Resolved - False Positive** and sends an email notification to the issue assignee (if set). {% endhint %} There are two ways to create an exclusion rule. You can define the exclusion criteria when you investigate a case, or you can create an issue exclusion from scratch. {% hint style="info" %} ### Note You can also set up issue exceptions by creating global endpoint policy exceptions. For more information, see [Add a global endpoint policy exception](/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md). {% endhint %} Issue exclusions support Scope-Based Access Control (SBAC). For more information, see [Manage user scope](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md). The following parameters are considered when editing a rule: * If **Scope-Based Access Control (SBAC)** is enabled and **Endpoint Scoping Mode** is set to restrictive mode, you can edit a rule if you are scoped to all tags in the rule. * If **Scope-Based Access Control (SBAC)** is enabled and **Endpoint Scoping Mode** is set to permissive mode, you can edit a rule if you are scoped to at least one tag listed in the rule. * If a rule was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.
Build an issue exclusion policy from issues in a case If after reviewing the case details, you want to suppress one or more issues from appearing in the future, create an exclusion policy based on the issues in the case. When you create a case from the **Cases** view, you can define the criteria based on the issues in the case. If desired, you can also create an issue exclusion policy from scratch. 1. On the **Cases** page, expand the case, click the case's menu icon and, select **Create Exclusion**. 2. Enter a name for your issue exclusion rule. 3. Describe the reason or purpose of the rule. 4. Use the issue filters to add any match criteria for the issue exclusion policy. You can also right-click a specific value in the issue to add it as match criteria. The app refreshes, to show you which issues in the case will be excluded. To see all matching issues, including those not related to the case, clear the option to **Show only issues** in the named case. 5. Click **Create** to create the exclusion rule and confirm the action. If you need to make changes later, you can view, modify, or delete the exclusion rule from the **Settings** → **Exception Configuration** → **Issue Exclusions** page.
Build an issue exclusion rule from scratch Build your own issue exclusion rule. 1. Select **Settings** → **Exception Configuration** → **Issue Exclusions**. 2. Select **+ Add an Issue Exclusion Rule**. 3. Enter a name for your issue exclusion rule. 4. Describe the reason or purpose of the rule. 5. Define the exclusion criteria. * Use the filters at the top of the table to build your exclusion criteria. * Use existing issue values to populate your exclusion criteria. To do so, right-click the column value on which you want to base your rule, and select **Add issues with \ to configuration**. As you define the criteria, the app filters the results to display matches. 6. Review the results. The issues in the table will be excluded from appearing in the app after the rule is created, and optionally, any existing issue matches will be displayed as unavailable.

Caution

This action is irreversible. All historically excluded issues will remain excluded if you disable or delete the rule.

7. Click **Create** to create the issue exception rule.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.