> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md).

# Add an IOC or BIOC rule exception

If you want to create a rule to take action on specific behaviors but also want to exclude one or more indicators from the rule, you can create an IOC or BIOC rule exception. An indicator can include the SHA256 hash of a process, process name, process path, vendor name, user name, causality group owner (CGO) full path, or process command-line arguments. For more information about these indicators, see [Detection rules](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules.md). For each exception, you also specify the rule scope to which the exception applies.

In case you need to map fields returned in an XQL process query to your exception configuration, the following table provides a matrix for the criteria mentioned in this procedure to the fields returned in a process query.

| IOC/BIOC suppression rule conditions | Process query result fields            |
| ------------------------------------ | -------------------------------------- |
| Process Sha256                       | actor\_process\_image\_sha256          |
| Process Name                         | actor\_process\_image\_name            |
| Process Path                         | actor\_process\_image\_path            |
| Signed By Vendor                     | actor\_process\_signature\_vendor      |
| User Name                            | actor\_effective\_username             |
| Cgo Full Path                        | actor\_process\_command\_line          |
| Process Cmd                          | causality\_actor\_process\_image\_path |

{% hint style="info" %}

### Note

Cortex XDR only supports exceptions with one attribute. See [Add an alert exclusion rule](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/alert-exclusions/add-an-alert-exclusion-rule.md) to create advanced exceptions based on your filtered criteria.
{% endhint %}

1. Select **Settings** → **Exception Configuration** → **IOC/BIOC Suppression Rules**.
2. Click **+ New Exception**.
3. Specify a rule name and an optional description.
4. Configure the indicators and conditions that define the exception.

   You can use wildcards to match the command line.
5. Select the scope of the exception, whether the exception applies to IOCs, BIOCs, or both.

   By default, all BIOC rules that match the criteria are excluded. To exclude only specific BIOC rules, select them from the provided rule list. You can add multiple rules.
6. **Save** the exception rule.

   By default, activity matching the indicators does not trigger any rule. As an alternative, you can select one or more rules. After you save the exception, the **Exceptions** count for the rule increments. If you later edit the rule, you will also see the exception defined in the rule summary.

**Export a rule exception**

You can choose to export a BIOC rule exception.

1. Select **Settings** → **Exception Configuration** → **IOC/BIOC Suppression Rules**.
2. In the **Exceptions** table, locate the exception rule you want to export. You can select multiple rules.
3. Right-click and select **Export**.

   If one or more of the selected exceptions are applied to a specific BIOC rule, select one of the following options:

   * **Export anyway**
   * **Export only non-specific Exceptions:** Only export exceptions are applied on all BIOC rules
   * **Export all Exceptions as non-specific:** Export and apply specific Exceptions to BIOC rules


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.