> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/apply-profiles-to-endpoints.md).

# Apply profiles to endpoints

Cortex XDR provides out-of-the-box protection for all registered endpoints with a default security policy customized for each supported platform type. To configure your security policy, customize the settings in a security profile and attach the profile to a policy.

Each policy you create must apply to one or more endpoints or endpoint groups. The **Prevention Policy Rules** table lists all the policy rules per operating system. Rules associated with one or more targets that are beyond your defined user scope are locked and cannot be edited.

1. From Cortex XDR, create a policy rule.

   Do one of the following:

   * Select **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**, and select **+ New Policy** or **Import from File**.

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>When importing a policy, select whether to enable the associated policy targets. Rules within the imported policy are managed as follows:</p><ul><li>New rules are added to the top of the list.</li><li>Default rules override the default rule in the target tenant.</li><li>Rules without a defined target are disabled until the target is specified.</li></ul></div>
   * Select **Endpoints** → **Policy Management** → **Prevention** → **Profiles**, right-click the profile you want to assign and click **Create a new policy rule using this profile**.
2. Define a **Policy Name** and optional **Description** that describes the purpose or intent of the policy.
3. Select the **Platform** for which you want to create a new policy.
4. Select the desired **Exploit**, **Malware**, **Restrictions**, and **Agent Settings** profiles you want to apply in this policy.

   If you do not specify a profile, the Cortex XDR agent uses the default profile.
5. Click **Next**.
6. Use the filters to assign the policy to one or more endpoints or endpoint groups.

   Cortex XDR automatically applies the platform filter you selected and, if it exists, the **Group Name** according to the groups within your defined user scope.
7. Click **Done**.
8. In the **Policy Rules** table, change the rule position, if needed, to order the policy relative to other policies.

   The Cortex XDR agent evaluates policies from top to bottom. When the Cortex XDR agent finds the first match it applies that policy as the active policy. To move the rule, select the arrows and drag the policy to the desired location in the policy hierarchy.

   Right-click to **View Policy Details**, **Edit**, **Save as New**, **Disable**, and **Delete**.
9. Export policy.

   Select one or more policies, right-click and select **Export Policies**. You can include the associated **Policy Targets**, **Global Exceptions**, and endpoint groups.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>The exported file is encoded in Base64 and cannot be edited.</p></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/apply-profiles-to-endpoints.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.