Manage automation rules

Learn how to manage automation rules for Cortex XDR.

Important

Before you create or manage automation rules, go to Settings → Configuration → Automation Settings and configure the settings for Endpoint Action Limit Thresholds and Automation Rules Notifications.

Add or edit an automation rule to trigger an action when the alert matches the condition of the rule created.

1. Navigate to Incident Response → Response → Automation and select Automation Rules.
2. Click Add Automation Rule.
3. For rule name and conditions, do the following:

   1. Enter a Rule Name and set the Rule Status.
   2. From the Alerts table, use the filter to retrieve the criteria to define the condition of the automation rule.
   3. Click Next.
4. From the Action list, select the relevant action to initiate when the alert condition is triggered.ActionFrom the
5. In the Exclude Endpoints page, select the endpoint and click Next.

   Note

   This option is only accessible to Action type Endpoint Response.
6. In the Summary page, verify the settings and click Done.