> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md).

# Set up restrictions prevention profiles

Restrictions prevention profiles limit the locations from which executables can run on an endpoint.

<details>

<summary>Windows</summary>

By default, the Cortex XDR agent receives a default profile that contains a pre-defined configuration for each restriction capability. The default setting for each capability is shown in parentheses in the user interface. To fine-tune your restrictions prevention policy, you can override the default configuration of each capability as follows. For each setting that you override, clear the **Use Default** option, and select the setting of your choice.

* **Block:** Block file execution.
* **Notify:** Allow file execution, but notify the user that the file is attempting to run from a suspicious location. The Cortex XDR agent also reports the event to Cortex XDR.
* **Report:** Allow file execution, but report it to Cortex XDR.
* **Disabled:** Disable the module, and do not analyze or report execution attempts from restricted locations.

Example 21.&#x20;

To customize the configuration for specific Cortex XDR agents, configure a new restrictions prevention profile and assign it to one or more policy rules. You can restrict files from running from specific local folders, or from removable media.

1. Add a new profile and define basic settings.
   1. From Cortex XDR, select **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>New profiles based on imported profiles are added, and do not replace existing ones.</p></div>
   2. Select the **Windows** platform, and **Restrictions** as the profile type.
   3. Click **Next**.
   4. For **Profile Name**, enter a unique name for the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name will be visible from the list of profiles when you configure a policy rule.
   5. For **Description**, to provide additional context for the purpose or business reason for creating the profile, enter a profile description. For example, you might include an incident identification number or a link to a help desk ticket.
2. Configure **Executable Files** to restrict file execution to pre-defined locations.

   | Item        | Option                                                                 | More details                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
   | ----------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Block</li><li>Notify</li><li>Report</li><li>Disabled</li></ul> | <p>When the Cortex XDR agent detects execution of files from outside the pre-defined locations, it performs the configured action.</p><ul><li><p>To add files or folders to the <strong>Block List</strong>, click <strong>+Add</strong>, enter the path, and press Enter. To add more files or folders, click <strong>+Add</strong> again.</p><ul><li>You can use a wildcard to match a partial name for the folder and environment variables.</li><li>Use <strong><code>?</code></strong> to match any single character, or <strong><code>\*</code></strong> to match any string of characters.</li><li>To match a folder, you must terminate the path with \* to match all files in the folder (for example, <code>c:\temp\*</code>).</li></ul></li><li>To add files or folders to the <strong>Allow List</strong>, define a list on the <strong>Legacy Agent Exceptions</strong> page.</li></ul> |
3. Configure **Network Location Files** to restrict access to all network locations except for explicitly trusted ones.

   | Item        | Option                                                                 | More details                                                                                                                                                                                                                                                                      |
   | ----------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Block</li><li>Notify</li><li>Report</li><li>Disabled</li></ul> | <p>When the Cortex XDR agent detects execution of files from network locations that are not trusted, it performs the configured action.</p><p>To add files or folders to the <strong>Allow List</strong>, define a list on the <strong>Legacy Agent Exceptions</strong> page.</p> |
4. Configure **Removable Media Files** to restrict file execution launched from external drives that are attached to endpoints in your network.

   | Item        | Option                                                                 | More details                                                                                                                                                                                                                                              |
   | ----------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Block</li><li>Notify</li><li>Report</li><li>Disabled</li></ul> | <p>When the Cortex XDR agent detects execution of files from removable media,it performs the configured action.</p><p>To add files or folders to the <strong>Allow List</strong>, define a list on the <strong>Legacy Agent Exceptions</strong> page.</p> |
5. Configure **Optical Drive Files** to restrict file execution launched from optical disc drives that are attached to endpoints in your network.

   | Item        | Option                                                                 | More details                                                                                                                                                                                                                                                     |
   | ----------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Block</li><li>Notify</li><li>Report</li><li>Disabled</li></ul> | <p>When the Cortex XDR agent detects execution of files from an optical disc drive, it performs the configured action.</p><p>To add files or folders to the <strong>Allow List</strong>, define a list on the <strong>Legacy Agent Exceptions</strong> page.</p> |
6. Configure **Custom Prevention Rules**.

   | Item        | Option                                     | More details                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
   | ----------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Enabled</li><li>Disabled</li></ul> | <p>When user-defined BIOC prevention rules are present in the system, you can enable them here. Ensure that the user-defined BIOC prevention rules that you want to enable only contain the following:</p><p><strong>Investigation types:</strong></p><ul><li>file\_event</li><li>process\_execution</li><li>remote\_code\_execution</li><li>network\_event</li><li>windows\_event\_log</li><li>module\_event</li></ul><p><strong>Subtypes:</strong></p><ul><li>file\_event</li><li>network\_event</li><li>registry\_event</li><li>windows\_event\_log</li></ul><p>Other event subtypes are not supported here, and rules containing them will not be available for selection.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Configure custom BIOC prevention rules here:</p><p><strong>Detection Rules</strong> → <strong>BIOC</strong></p></div> |
7. To save the profile, click **Create**.

**What to do next**

If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:

Create a policy rule from the Prevention Profiles page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Profiles**.
2. Right-click your new profile, and select **Create a new policy rule using this profile**.
3. Configure the policy rule.

Edit an existing policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Right click an existing policy and select **Edit**.
3. Add your new profile to the policy rule.

Create a new policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Click **Add Policy**.
3. Configure a new policy that includes your new profile.

</details>

<details>

<summary>macOS</summary>

1. Add a new profile and define basic settings.
   1. From Cortex XDR, select **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>New profiles based on imported profiles are added, and do not replace existing ones.</p></div>
   2. Select the **macOS** platform, and **Restrictions** as the profile type.
   3. Click **Next**.
   4. For **Profile Name**, enter a unique name for the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name will be visible from the list of profiles when you configure a policy rule.
   5. For **Description**, to provide additional context for the purpose or business reason for creating the profile, enter a profile description. For example, you might include an incident identification number or a link to a help desk ticket.
2. Configure **Custom Prevention Rules**.

   | Item        | Option                                     | More details                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
   | ----------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Enabled</li><li>Disabled</li></ul> | <p>When user-defined BIOC prevention rules are present in the system, you can enable them here. Ensure that the user-defined BIOC prevention rules that you want to enable only contain the following:</p><p><strong>Investigation types:</strong></p><ul><li>file\_event</li><li>process\_execution</li><li>remote\_code\_execution</li><li>network\_event</li><li>windows\_event\_log</li><li>module\_event</li></ul><p><strong>Subtypes:</strong></p><ul><li>file\_event</li><li>network\_event</li><li>registry\_event</li><li>windows\_event\_log</li></ul><p>Other event subtypes are not supported here, and rules containing them will not be available for selection.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Configure custom BIOC prevention rules here:</p><p><strong>Detection Rules</strong> → <strong>BIOC</strong></p></div> |
3. To save the profile, click **Create**.

**What to do next**

If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:

Create a policy rule from the Prevention Profiles page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Profiles**.
2. Right-click your new profile, and select **Create a new policy rule using this profile**.
3. Configure the policy rule.

Edit an existing policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Right click an existing policy and select **Edit**.
3. Add your new profile to the policy rule.

Create a new policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Click **Add Policy**.
3. Configure a new policy that includes your new profile.

</details>

<details>

<summary>Linux</summary>

1. Add a new profile and define basic settings.
   1. From Cortex XDR, select **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>New profiles based on imported profiles are added, and do not replace existing ones.</p></div>
   2. Select the **Linux** platform, and **Restrictions** as the profile type.
   3. Click **Next**.
   4. For **Profile Name**, enter a unique name for the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name will be visible from the list of profiles when you configure a policy rule.
   5. For **Description**, to provide additional context for the purpose or business reason for creating the profile, enter a profile description. For example, you might include an incident identification number or a link to a help desk ticket.
2. Configure **Custom Prevention Rules**.

   | Item        | Option                                     | More details                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
   | ----------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Action Mode | <ul><li>Enabled</li><li>Disabled</li></ul> | <p>When user-defined BIOC prevention rules are present in the system, you can enable them here. Ensure that the user-defined BIOC prevention rules that you want to enable only contain the following:</p><p><strong>Investigation types:</strong></p><ul><li>file\_event</li><li>process\_execution</li><li>remote\_code\_execution</li><li>network\_event</li><li>windows\_event\_log</li><li>module\_event</li></ul><p><strong>Subtypes:</strong></p><ul><li>file\_event</li><li>network\_event</li><li>registry\_event</li><li>windows\_event\_log</li></ul><p>Other event subtypes are not supported here, and rules containing them will not be available for selection.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Configure custom BIOC prevention rules here:</p><p><strong>Detection Rules</strong> → <strong>BIOC</strong></p></div> |
3. To save the profile, click **Create**.

**What to do next**

If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:

Create a policy rule from the Prevention Profiles page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Profiles**.
2. Right-click your new profile, and select **Create a new policy rule using this profile**.
3. Configure the policy rule.

Edit an existing policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Right click an existing policy and select **Edit**.
3. Add your new profile to the policy rule.

Create a new policy rule from the Policy Rules page:

1. Navigate to **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**.
2. Click **Add Policy**.
3. Configure a new policy that includes your new profile.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.