> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-an-ioc/create-an-ioc-rule.md).
# Create an IOC rule
{% hint style="info" %}
### License Type
Adding IOC rules requires a Cortex XDR Pro license.
{% endhint %}
Create new indicator of compromise (IOC) rules and optionally define rule expiration for all IOC rules. You can create an IOC rule either by configuring a single one or by uploading a file that contains multiple IOCs.
{% hint style="info" %}
### Note
To ensure your IOC rules raise alerts efficiently and do not overcrowd your Alerts table, Cortex XDR automatically does the following:
* Disables any IOC rules that reach 5000 or more hits over a 24 hour period.
* Creates a rule exception based on the PROCESS SHA256 field for IOC rules that hit more than 100 endpoints over a 72 hour period.
{% endhint %}
1. In **Detection Rules** → **IOC**, select **+ Add IOC**.
2. Configure the IOC criteria.
Configure a single IOC
After investigating a threat, if you identify a malicious artifact, you can create an alert for the **Single IOC** right away.
1. Configure the **INDICATOR** value on which you want to match.
2. Configure the IOC **TYPE**. Options are **Full Path**, **File Name**, **Domain**, **Destination IP**, and MD5 or SHA256 **Hash**.
3. Configure the **SEVERITY** you want to associate with the alert for the IOC.
4. (Optional) Enter a comment that describes the IOC.
5. (Optional) Configure the IOC's **REPUTATION** and its **RELIABILITY**.
6. (Optional) Configure the **EXPIRATION** settings for this IOC. **Default**, **Specific Expiration Date**, **No Expiration**.
7. Click **Save**.
Upload multiple IOCs
If you want to match multiple indicators, you can upload the criteria in a CSV file. You can upload IOCs using REST APIs in either CSV or JSON format.
Upload a file, one IOC per line, that contains up to 20,000 IOCs. For example, you can upload multiple file paths and MD5 hashes for an IOC rule. To help you format the upload file in the syntax that Cortex XDR accepts, you can download the example file.
1. Select **Upload File**.
2. Drag and drop the CSV file containing the IOC criteria in the drop area of the **Upload File** dialog or **Browse** for the file. Cortex XDR supports a file with multiple IOCs in a pre-configured format. For help in determining the format syntax, Cortex XDR provides an example text file that you can download.
3. Configure the **SEVERITY** you want to associate with the alert for the IOCs.
4. Define the **DATA FORMAT** of the IOCs in the CSV file. Options are **Mixed**, **Full Path**, **File Name**, **Domain**, **Destination IP**, and MD5 or SHA256 **Hash**.
5. (Optional) Configure the IOC's **REPUTATION** and its **RELIABILITY**.
6. (Optional) Enter an **EXPIRATION** for the IOC. **Default**, **Specific Expiration Date**, **No Expiration**.
7. Click **Upload**.
3. (Optional) Define any expiration criteria for your IOC rules.
You can also configure additional expiration criteria per IOC type to apply to all IOC rules of that type. In most cases, IOC types like Destination IP or Host Name are considered malicious only for a short period of time since they are soon cleaned and then used by legitimate services, from which time they only cause false positives. For these types of IOCs, you can set a defined expiration period. The expiration criteria you define for an IOC type will apply to all existing rules and additional rules that you create in the future. By default, Cortex XDR does not apply an expiration date set on IOCs.
1. Select **Default Rule Expiration**.
2. Set the expiration for any relevant IOC type. Options are **Never**, **7 Days**, **30 days**, **90 days**, or **180 days**.
3. Click **Save**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-an-ioc/create-an-ioc-rule.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.