> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies.md). # Rules and Policies - [About Rules and Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/about-rules-and-policies.md): Discover how Cortex Cloud detects security risks across your infrastructure, workloads, and container images, and how policies automate the response. - [Cloud security rules and policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies.md): Learn how cloud security rules and policies detect threats and misconfigurations across your environment. - [Cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-rules.md): Learn about out-of-the-box and custom cloud security rules. - [Cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-policies.md): Learn about cloud security policies. - [Create and manage cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules.md): Create and manage custom cloud security rules for detecting cloud security risks. - [Create a graph rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md): Create custom graph detection rules that identify risky relationships and attack paths. - [Create a configuration rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-configuration-rule.md): Create configuration rules that identify cloud resource misconfigurations and policy violations. - [Create a data rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-data-rule.md): Create data rules to detect data risks, malware, and classification issues. - [Create an identity rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-identity-rule.md): Create identity rules to detect excessive or unused cloud permissions. - [Create a network exposure rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-network-exposure-rule.md): Create network exposure rules to detect risky inbound, outbound, and east-west access. - [Create an AI rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md): Create AI rules to detect risks and misconfigurations across your AI ecosystem. - [Create an attack path (legacy) rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-attack-path-rule.md): Create attack path rules that identify breach paths to high-value cloud assets. - [View cloud security rule status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/view-cloud-security-rule-status.md): View, filter, and sort the status of cloud security rules. - [Edit a cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/edit-a-cloud-security-rule.md): Edit cloud security rules and understand how changes affect related issues. - [Enable or disable a rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/enable-or-disable-a-rule.md): Enable or disable cloud security rules to control when they evaluate assets. - [Use an existing rule to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/use-an-existing-rule-to-create-a-new-one.md): Duplicate an existing cloud security rule and customize it for your needs. - [Delete a custom cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/delete-a-custom-cloud-security-rule.md): Delete custom cloud security rules that are no longer needed. - [Create and manage cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies.md): Create and manage cloud security policies. - [Create a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/create-a-cloud-security-policy.md): Create a cloud security policy that applies security rules to selected cloud assets. - [Edit a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/edit-a-cloud-security-policy.md): Edit cloud security policies to update their details, rules, and scopes. - [Enable or disable a policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/enable-or-disable-a-policy.md): Enable or disable custom and default cloud security policies. - [Use an existing policy to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/use-an-existing-policy-to-create-a-new-one.md): Duplicate an existing cloud security policy and tailor it to your needs. - [Delete a custom cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/delete-a-custom-cloud-security-policy.md): Remove custom cloud security policies that are no longer needed. - [Cloud workload policies and rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules.md): Learn how cloud workload policies and rules protect your workloads. - [How policies and rules work together](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/how-policies-and-rules-work-together.md): Understand how policies apply cloud workload rules to your workloads. - [Cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md): Create and manage policies that apply protection rules to cloud workloads. - [Types of cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies.md): Learn about cloud workload policy types and their use cases. - [Trusted image cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/types-of-cloud-workload-policies.md): Use trusted image policies to control which container images can run. - [Cloud Workload Policies page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md): Use the Cloud Workload Policies page to view and manage policies. - [Enable or disable a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/enable-or-disable-a-cloud-workload-policy.md): Enable or disable a cloud workload policy to control its enforcement. - [Create a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/create-a-cloud-workload-policy.md): Create a cloud workload policy to apply rules to selected workloads. - [Use an existing policy to create a new cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/use-an-existing-policy-to-create-a-new-cloud-workload-policy.md): Duplicate an existing policy and customize it for new workload requirements. - [Edit a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/edit-a-cloud-workload-policy.md): Edit a cloud workload policy to update its rules and scope. - [Delete a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/delete-a-cloud-workload-policy.md): Delete cloud workload policies that are no longer needed. - [Cloud workload preventive action](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md): Understand preventive actions that block noncompliant cloud workloads. - [Cloud workload rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules.md): Create and manage rules that detect and prevent cloud workload risks. - [Default (pre-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/default-pre-defined-rules.md): Learn about built-in cloud workload rules and their detection coverage. - [Custom (user-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/custom-user-defined-rules.md): Create and manage custom rules for cloud workload detection. - [Cloud Workload Rules page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page.md): Use the Cloud Workload Rules page to view and manage rules. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule.md): Create a custom detection rule for cloud workload security risks. - [Use an existing rule to create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/use-an-existing-rule-to-create-a-new-custom-detection-rule.md): Duplicate an existing rule and customize it for new detection needs. - [Edit a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/edit-a-custom-detection-rule.md): Edit a custom detection rule to update its detection logic and scope. - [Delete a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/delete-a-custom-detection-rule.md): Delete custom detection rules that are no longer needed. - [Base image rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule.md): Learn about how base image rules identify and manage approved container images. - [Create a base image rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule/create-a-base-images-rule.md): Create a base image rule to define trusted container image criteria. - [Find the base image for an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule/prerequisites.md): Find an asset’s base image to investigate its image lineage and risk. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.