> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/manage-existing-indicators.md). # Manage existing indicators After you create an indicator rule, you can take the following actions: {% hint style="info" %} ### Note For Analytics BIOC rules, you can only disable and enable rules. {% endhint %}
View alerts triggered by a rule As your IOC and BIOC rules trigger alerts, Cortex XDR displays the total **# OF ALERTS** triggered by the rule in the the BIOC or IOC rules page. For rules with a high, medium, or low severity that have triggered one or more alerts, you can quickly pivot to a filtered view of those alerts triggered by the indicator: 1. Select **Detection & Threat Intel** → **Detection Rules** and the type of rule (**BIOC** or **IOC**). 2. Right-click anywhere in a rule, and then select **View associated alerts**. You can view a filtered query of alerts associated with the Rule ID.
Use a BIOC rule as the basis of a query 1. Select **Detection & Threat Intel** → **Detection Rules** and the type of rule (**BIOC** or **IOC**). 2. Right-click anywhere in the rule, and then select **Open in query builder**. Cortex XDR populates a query using the criteria of the BIOC rule. 3. Add or change the query criteria as required. 4. (Optional) **Test** your query to see the sample results. 5. If you are satisfied with the query, **Save** it. For more information, see [Edit and rerun queries in Query Center](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/overview-of-the-query-center/edit-and-rerun-queries-in-query-center.md).
Edit a rule After you create a rule, it may be necessary to tweak or change the rule settings. You can open the rule configuration from the Rules page or from the pivot menu of an alert triggered by the rule. To edit the rule from the Rules page: 1. Select **Detection & Threat Intel** → **Detection Rules** and the type of rule (**BIOC** or **IOC**). 2. Locate the rule you want to edit. 3. Right-click anywhere in the rule and select **Edit**. 4. Edit the rule settings as needed, and then click **OK**. If you make any changes, **Test** and then **Save** the rule.
Export a rule (BIOC only) 1. Select **Detection & Threat Intel** → Detection Rules → **BIOC**. 2. Select the rules that you want to export. 3. Right-click any of the rows, and select **Export selected**. The exported file is not editable, however, you can use it as a source to import rules at a later date.
Copy a BIOC rule You can use an existing rule as a template to create a new one. Global BIOC rules cannot be deleted or altered, but you can copy a global rule and edit the copy. 1. Select **Detection & Threat Intel** → **Detection Rules** and then **BIOC**. 2. Locate the rule you want to copy. 3. Right-click anywhere in the rule row and then select **Save as New** to create a duplicate rule.
Disable or remove a rule If you no longer need a rule you can temporarily disable or permanently remove it. {% hint style="info" %} ### Note You cannot delete global BIOCs delivered with content updates. {% endhint %} 1. Select **Detection & Threat Intel** → **Detection Rules** and the type of rule (**BIOC** or **IOC**). 2. Locate the rule that you want to change. 3. Right-click anywhere in the rule row and then select **Remove** to permanently delete the rule, or **Disable** to temporarily stop the rule. If you disable a rule you can later return to the rule page to **Enable** it.
Partially disable or re-enable a BIOC rule You can disable one or more BIOC rules on the agent, on the server, or on both. This provides you more granularity for managing the prevention actions triggered by the BIOC Rules. 1. Navigate to **Detection Rules** → **BIOC**. 2. Select the rules you want to disable. 3. Right-click any of the rules and select to disable the rules on the agent, on the server, or on both.

Note

For BIOC rules that are applied to prevention profiles:

4. We recommend you supply a reason for disabling the rule. {% hint style="info" %} ### Note When a BIOC rule is disabled automatically by Cortex XDR, for example due to the server anti flooding mechanism, prevention on the agent works as before. {% endhint %} You can re-enable a rule granularly for detection, prevention, or both in the same way.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/manage-existing-indicators.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.