> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md).

# Create an AI rule

AI rules identify misconfigurations and security flaws across your organization's AI ecosystem. These rules detect risks associated with AI infrastructure, supply chains, and data models for services such as AWS Bedrock, Amazon SageMaker, Azure OpenAI, and GCP Vertex AI.

Perform these steps to create a custom AI rule:

1. Navigate to **Posture Management** → **Rules & Policies** → **Rules** → **Cloud Security**.
2. Click on **Create Rule** → **AI**.
3. In the **Overview** step, provide the following:
   1. Enter a **Rule Name and Description.**
   2. Select a **Severity.** Findings generated by this rule will inherit this severity.
   3. (Optional) Add **Labels**.
   4. (Optional) Enable **Remediation** using the toggle. In a later step, you'll enter the remediation instructions.
   5. (Optional) Associate this rule with a **Compliance Control**. Click **Add**, select one or more custom compliance controls from the list, and then click **Assign**. Custom configuration rules can only be associated with custom compliance controls.
   6. Click **Next**.
4. In the **Rule Logic** step, use the query builder to define the detection criteria.
   1. Use the "Select" dropdown to choose AI services, such as Dataset, AI Model, Model Endpoint.
   2. Click **WHERE** to choose from the attributes of an asset. The list of attributes displayed varies, depending on the asset category you selected.
   3. Set conditions, building logical statements that use attributes specific to AI assets. For example, you can create a rule that flags AI models trained on sensitive data buckets or AI models that have public exposures.
   4. Click **Search** to see real-time results from your environment.
5. Click **Next** to define Remediation instructions (if you had turned on **Enable Remediation** in the Overview step) or click **Done**.
6. (Optional) In the text field, define remediation actions or provide other information that will be included on issues created by this rule.
7. Click **Done** to save your rule.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.