> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/create-an-automation-rule.md).

# Create an automation rule

Automation rules allow users to automatically respond to events by defining trigger conditions and desired actions to perform once the condition is met. Automation rules can trigger playbooks abd Quick Actions.

While per-object access determines who can see, edit, or manually trigger a playbook, any automated execution (including those triggered by automation rules, jobs, or feed-triggered actions) is performed by the system. These actions are not restricted by the organizational scope or object-level access of the user who may have triggered the case. Instead, automated workflows remain governed by the defined scope and permissions of the involved integrations.

{% hint style="info" %}
**NOTE:**

In addition to the Automation Rules feature, the XDR Automation menu item is available if you migrated from Cortex XDR 3.x to Cortex XDR 5.x and had rules configured in your previous environment.

* **Location:** These legacy rules are located under Investigation & Response → Automation → XDR Automation.
* **Operational but read-only:** Existing rules from your Cortex XDR 3.x environment continue to function as originally configured, but they are now read-only. You cannot edit existing legacy rules or create new rules within this section.
* **Migration:** We recommend transitioning your legacy automation logic to the new Automation Rules, found under Investigation & Response → Automation → Automation Rules.
* **Functional difference:** Legacy XDR Automation rules allowed for multiple independent actions to be assigned to a single trigger. In contrast, the new Automation Rules trigger a single Playbook or Quick Action per issue.
  {% endhint %}

<details>

<summary>Rules and playbook access</summary>

When working with automation rules, consider how object-level access affects visibility and configuration:

* **Role permissions for rules**: To create automation rules or edit existing ones that trigger Quick Actions and playbooks, you must have **Scripts** and **Playbooks** enabled in your role (under **Investigation & Response** → **Automations** with **Edit Public Playbooks** selected).
* **Rule visibility vs. playbook access**: You can view all automation rules in the list, including those configured to trigger playbooks you do not have access to. This ensures full visibility into the order and logic of automated workflows in your environment.
* **Playbook selection**: While all rules are visible, you can only select a playbook ito which you have at least **Viewer** access.

If certain options are unavailable, contact your administrator. For more information, see [Manage access to playbooks and scripts](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md).

</details>

<details>

<summary>Rule behavior and structure</summary>

* **Evaluation order**: Rules are evaluated in order, and only the first rule that matches the trigger conditions is executed.
* **Trigger timing**: Automation rules trigger only upon the initial ingestion of an issue. Subsequent updates will not re-trigger the rule, even if the issue still meets the criteria.
* **Structure**: The rules consist of three parts:
  * **WHEN**: Stands for the trigger type. **WHEN** is set to **Issue is created**.
  * **IF**: Stands for the conditions that need to be met for the rule to run.
  * **THEN**: The automation that the user wants to execute: playbook, Quick action, or agent.

</details>

In the **Automation Rules** page, you can create or edit an automation rule, use recommended automation rules, edit a playbook, and change the order of priority. You can also delete or disable/enable an automation rule. When you disable an automation rule, the automation does not run for the selected condition.

{% hint style="info" %}
You can also define the conditions that trigger a specific playbook in the playbook editor. For more information, see [Configure playbook settings](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/configure-playbook-settings.md).
{% endhint %}

<details>

<summary>Create or edit an automation rule to trigger a Quick Action or playbook</summary>

Create an automation rule for issues where conditions from the automation rule are met, so that the automation, whether it is a Quick Action or a playbook, automatically runs.

For example, if the **IF** condition is `severity=critical` and the **Then** action is the Quick Action - **Create Jira Ticket**, the automation rule is triggered when a critical severity issue is detected, and then the Jira ticket is created.

1. Select **Investigation & Response** → **Automation** → **Automation Rules**.
2. Click **Add Automation Rule** or right-click a rule, select **Edit rule**, or click the edit button.
3. Enter a rule name.
4. (Optional) Provide a short description of the rule.
5. (Optional) Change the rule status. A rule can be enabled or disabled.
6. Define the rule conditions:
   1. For **If**, click **Add Condition** and from the **Issues** table, use the filter to set the criteria for the rule, and then click **Save**.

      For example, filter the field **Severity**, and then select the value **Critical**. The **Issues** table returns all issues where the severity=critical.
   2. For **Then**, click **Add Automation**.
      1. If you clicked **Add Agent**, choose an agent from the **Select Agent** window. You can search for an agent or click on any of the agents shown. Hovering over an agent card shows a summary and the option to click **Show agent** to view the full list of actions available to the agent.
   3. Choose the playbook or Quick Action to which you have access from the **Select Automation** window. You can search for an automation or click on any of the Quick Actions and playbooks shown.
      * **Quick Actions**: After selecting a Quick Action, you can set action parameters. For the **Create Jira Ticket** Quick Action, for example, you can enter the Description, Issue Type, Project Key, and Summary.

        <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Quick Actions, by default, run using all available integration instances that contain the command. When selecting a Quick Action for an automation rule, you can instead choose one specific integration instance to use.</p></div>

        For more information on Quick Actions, see [Quick Actions](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/quick-actions.md).
      * **Playbooks**: Click ![playbooks\_automation\_view.png](/files/9WjeWXjqnD7WT2s2W9MW) to view the description and playbook preview.

        If you want to use a playbook that is not part of your **Org Playbooks**, show **Playbook Catalog** for a full list of available playbooks. For more information on playbooks, see [Playbooks](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks.md).

        The list of available playbooks is filtered based on your access; you will only see playbooks that you own, that have been shared with you, or that are marked as **Public**. For more information, see [Manage access to playbooks and scripts](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md).
   4. Click **OK**.
7. Click **Create**.

</details>

<details>

<summary>Add a recommended automation rule</summary>

You can add automation rules recommended by Cortex XDR.

1. Select **Investigation & Response** → **Automation** → **Automation Rules**.
2. Click **View Recommendations**.
3. In the **Automation Rule Recommendations** table, view and select the required recommended automation rules to add to the **Automation Rules** table.

   For playbooks, you can click the playbook name to preview. For Quick Actions, you can view the description and available parameters.
4. Click **Add Selected rules**.
5. Verify the order of the automation rule and change the order (if required),
6. Save the changes to the **Automation Rules** table.

</details>

After you create an automation rule, the rule is added to the **Automation Rules** table. In the **Automation Rules** table, you can do the following:

* Set the priority of the automation rules, so when an issue is created, the first rule takes priority, then the second, third, etc. Only the first matching rule is executed.

  New rules created manually are added to the bottom of the table.
* View details of the automation rules that have been created.

  By default, you can see the condition, automation, and the creation dates and source. You can add columns and filters as required. To edit, disable, or delete an automation rule, right-click on the rule.

<details>

<summary>Scope-based access control for automation rules</summary>

Automation rules support SBAC (scope-based access control). The following parameters are considered when editing a rule:

* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to restrictive mode, you can edit an automation rule if you are scoped to all tags in the rule.
* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to permissive mode, you can edit an automation rule if you are scoped to at least one tag listed in the rule.
* As a scoped user who has editing permissions to a rule, you can change the order among other rules that are locked.
* If a rule was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/create-an-automation-rule.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.