Manage automation rules

Procedure of how to manage the automation rules of Cortex XDR as needed, which includes to edit, save as new, disable, delete or copy.

Notice

This functionality requires a Cortex XDR Pro license.

Danger

Before you create or manage automation rules, go to Settings → Configuration → Automation Settings and configure the settings for Endpoint Action Limit Thresholds and Automation Rules Notifications.

You can add or edit an automation rule to trigger an action when the alert matches the condition of the rule created.

Note

Automation rules trigger only upon the initial ingestion of an issue. Subsequent updates will not re-trigger the rule, even if the issue still meets the criteria.

1. Navigate to Incident Response → Response → Automation and select Automation Rules.
2. Click Add Automation Rule, or to edit and existing rule hover over the rule and select the edit icon.
3. Define rule name and conditions:

   1. Enter a rule name and set the rule status.
   2. From the Alerts table, use the filter to retrieve the criteria to define the condition of the automation rule.
   3. Click Next.
4. From list, select the relevant action to initiate when the alert condition is triggered.
5. In the Exclude Endpoints page, select the endpoints to exclude and click Next.

   Note

   This option is only accessible to Action type Endpoint Response.
6. In the Summary page, verify the settings and click Done.
7. Manage the automation rule, as needed. Right-click a rule to see the available actions.