> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md).

# Create detection rules based on graph search

{% hint style="success" %}
**Prerequisites**\
**License:** This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Graph Search requires View or View/Edit RBAC permissions for Graph Search under **Investigation & Response → Search**.
{% endhint %}

The Graph Engine is a Cortex detection method that identifies threats by analyzing relationships between entities rather than evaluating individual events in isolation.\
The engine periodically queries a contextual security graph that represents your environment as:<br>

* Nodes, such as identities, configurations, code repositories, data stores, and cloud resources.
* Edges and paths, which represent the relationships and access routes between those entities.\
  Graph detection rules evaluate these relationships to identify risky combinations and potential attack paths. When a rule matches, the Graph Engine creates a live, evidence-backed issue in the Cortex issues experience.

The Graph engine includes system graph rules by default. You can also create your own custom rules to identify attack paths in your organization.

### Key characteristics

* **Detection type:** Graph-based detection that evaluates relationships and paths between entities.
* **Cyclic evaluation**: Graph rules run periodically rather than evaluating each event as it arrives. By default, the engine runs every 6 hours.
* **Path-based issue:** Each issue is uniquely identified by the rule ID and the graph path that triggered it. This allows the engine to track matching paths across evaluation cycles and automatically close issues generated by outdated rule versions.
* **Rule output**: The Graph Engine creates issues that appear in the Cortex issues experience.

## Create a detection rule based on a graph search

A graph detection rule tells the engine what pattern of connected entities to look for in the contextual search graph. Each rule pairs a graph query with metadata, for example, severity, category, description, resolution plan. When the query matches one or more paths in the graph, each matching path triggers a security issue.

To create a rule, navigate to **Investigation & Response → Graph Search**.

1. Build your query as detailed in [Create Graph Search query](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Create-Graph-Search-query).
2. In the three dot menu, click **Save as Rule**.
3. In the **New Graph Rule** page, under **General**, add the following details

* Main Settings:
  * **Name**: A unique name for the rule.
  * **Description**: A description of the rule.
  * **Labels** (optional): Add labels to the rule.
  * **Severity**: Select a severity level for the issue that will be triggered.
  * **Remediation** (optional): Provide remediation instructions.
* **Compliance Controls** (optional): Select a control from the controls catalog.

4. In the **Condition** page, the graph query you have built is displayed. You can use the relevant options to edit your query. For more information about how to build your graph query, see [Create Graph Search query](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x-Documentation/Create-Graph-Search-query). Use **Generate Preview** to view the results of your query.
5. In The **Summary** page, review the rule and click Save.

After the rule is synced and enabled, the Graph engine picks it up on the next cycle and triggers issues for every matching path.

### View and manage Graph rules

To view the Graph generated rules, in **Posture Management → Rules & Policies → Rules → Cloud Security**, filter the Rules widget by **Graph**. Manage the graph rules using the right click actions:

* System rules: Disable
* Custom rules: Disable, Edit, Save as, Delete

Click each row in the table to view the rule details in the side panel. To view the results of the query, next to the query click **Show in Graph Search**. The panel also displays any issues generated by the rule, affected assets, linked cases, and the graph evidence.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.