> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule-for-endpoints.md).

# Add a disable prevention rule for endpoints

Create an exception that disables prevention for selected endpoints.

You can create granular exceptions to prevention actions defined for your endpoints. In your disable prevention rules, you can specify hash types, file/folder paths, signers, certificate thumbprint, command line, or processes to exclude from the prevention actions triggered by specific security modules. These rules may be useful when you have processes that are essential to your organization, and must not be terminated. To cover all your endpoints, you can configure different exception rules per platform. Cortex XDR still generates issues from the disabled rules.

{% hint style="info" %}

### Important

* All applicable prevention actions are skipped for the files and process that match the properties defined in the rule.
* Consider the consequences of disabling a prevention rule before you add the exception, and monitor it over time.
* You can only apply a Disable Prevention Rule to endpoints running Cortex XDR agents version 7.9 and later.
  {% endhint %}

1. Go to **Settings** → **Exception Configuration** → **Disable Prevention Rules**.
2. Click **+Add Rule**.
3. For **Rule Name**, enter a meaningful name for the rule.
4. (Optional) Enter a description for the business reason or intent for the rule.
5. Click **Next**.
6. For **Platform**, select the operating system that you require.
7. Under **Target Properties**, you can configure any combination of parameters. If a parameter is not specified, all values are allowed.

   When you specify two or more values, the exception is applied only if the file satisfies all the specified target properties.

   You can use wildcards for matching the **Command Line** or **Files/Folders** path.

   * **Hash:** enter a specific SHA256 hash
   * **Files/Folders:** specify the path to the required files or folders
   * **Command Line:** specify a command line argument
   * **Signer Name:** specify a trusted signer
   * **Certificate Thumbprint:** specify a certificate thumbprint
8. For **Modules**, select one or more security modules that won't trigger prevention actions.

   The actions triggered by the other modules are not affected.
9. For **Scope**, select the scope for the rule:
   * If you want to apply the rule to all endpoints, select **Global (all endpoints)**.
   * If you want to apply the rule to only specific exception profiles, click **Exception Profiles**, and then select them from the list.
10. Click **Next**.
11. Review the configurations for the exception, and if the risks are acceptable to you, select **I understand the risk**, and then click **Create**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule-for-endpoints.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.