> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/automation-settings.md).

# Automation settings

Before you begin creating automation rules, consider setting thresholds for the following endpoint actions:

{% hint style="info" %}

### Note

Only administrator can configure these settings.
{% endhint %}

| **Endpoint Action Limit Thresholds**                         | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Isolate endpoint on up to \_ endpoints in \_ hour/s          | <p>When an alert condition is triggered, and the action specified is to isolate the endpoint, the limit threshold defined enables the set number of endpoints to be isolated for the period of time defined. This is to prevent an overflow of endpoints isolated from the network at the same time.</p><p>If the setting is turned off, there is no threshold for the isolation of endpoints.</p>                                                                                                                                                                                                |
| Run endpoint script on up to \_ endpoints in \_ hour/s       | <p>When an alert condition is triggered, and the action specified is to run the endpoint script, the limit threshold defined enables the set number of endpoints to run the script for the period of time defined. This is to prevent an overflow of endpoints running scripts at the same time.</p><p>If the setting is turned off, there is no threshold for the running scripts on the endpoints.</p>                                                                                                                                                                                          |
| Terminate Causality (CGO) on up to \_ endpoints in \_ hour/s | <p>When an alert condition is triggered, and the action specified is to terminate causality, the limit threshold defined enables the set number of endpoints to terminate the causality chain of processes for the period of time defined. This is to prevent an overflow of endpoints terminating causality chain of processes at the same time.</p><p>If the setting is turned off, there is no threshold for terminating causality on the endpoints.</p>                                                                                                                                       |
| Forensic Triage on up to \_ endpoints in \_ hour/s           | <p>When an alert condition is triggered, and the action specified is set to Forensic Triage, the limit threshold defined enables the set number of endpoints to triage for the period of time defined. This is to prevent an overflow of endpoints to triage at the same time.</p><p>If the setting is turned off, there is no threshold for the running scripts on the endpoints.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>This option is only accessible to users that have the forensics add-on license.</p></div> |

| **Automation Rule Notifications** | **Description**                         |
| --------------------------------- | --------------------------------------- |
| Distribution List                 | Enter the email of the people to notify |
| Slack                             | Enter the slack contact to notify.      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/automation-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.