Use a built-in or custom control

Add built-in controls or create and manage custom controls for custom standards.

When using custom standards, you can use built-in controls or create custom controls and then associate them with detection rules.

Add a built-in control to a custom standard

Cortex XDR provides built-in controls that cannot be edited or deleted. When you edit or create a custom standard you can add the built-in controls.

Create a custom control to use in a custom standard

You can create a new control that is tailored to your own business needs, standards, and organizational policies to use in a custom standard.

1. In the Controls catalog, click + Create Control.

2. Define control metadata, including:

   • A single category

   • A single sub category (optional)

   • Control name

   • ​Description (optional)

   • One or more custom standards to associate the control with

3. Click Create.

4. Assign a custom detection rule to the control. See Associate a custom control to a detection rule.

Associate a custom control to a detection rule

You can associate custom compliance controls with workload security and cloud security rules to tailor compliance checks to your organization's needs. This can be done during rule creation (custom rules only) and edit (for both custom and out-of-the-box rules).

NOTE

Custom rules can only be associated with custom compliance controls.

The following table summarizes which rule types can be associated with custom compliance controls:

	OOTB rules	Custom rules
Cloud workload rules	N/A	When creating or editing custom cloud workload rules, you can associate custom compliance controls with them.
Cloud security rules NOTE You can only associate custom compliance controls to the following cloud security rule types: ConfigIdentityAI	You can edit existing out-of-the-box cloud security rules and associate custom compliance controls with them.	When creating or editing custom cloud cloud security rules, you can associate custom compliance controls with them.

When creating or editing a cloud workload or cloud security rule you can associate a custom compliance control with it.

1. Navigate to Posture Management → Rules & Policies → Rules → Cloud Workload or Cloud Security.

2. From here, you can do the following:

   1. Click Create Policy to create a new policy.

   2. Search for an existing rule, click it, and then select Edit from the menu.

3. In the Overview → Compliance Controls field, click Add to add compliance controls to the rule.

4. Click Add, select one or more custom compliance controls from the list, and then click Assign.

5. After you have saved the changes, the custom detection rule is assigned to the custom control.

Manage existing controls

Existing compliance controls can be managed from Posture Management → Compliance → Controls Catalog.

Edit or delete a custom control

Custom controls can be edited or deleted. Right click on a control or select from the control's side pane to access the Edit and Delete options. When editing a control, you can update all its parameters.

Clone a control

All controls can be cloned using the Save as new option. Right click on a control or select from the control's side pane to access the option to Save as new. When cloning a control, you can update all its parameters. By default the original built-in control name is used with “_copy“ appended.