> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies.md).

# Rules and Policies

Discover how Cortex XSIAM detects security risks across your infrastructure, workloads, and container images, and how policies automate the response.

### Overview

Cortex XSIAM uses rules and policies to detect security risks and manage responses across your cloud environment.

* **Rules**: Define what to check. Each rule contains the detection logic for a single condition (such as a misconfiguration, vulnerability, exposed secret, or compliance gap) and produces a finding when triggered.
* **Policies**: Define how, where, and when rules apply. A policy binds rules to a target scope (such as accounts, asset groups, namespaces, or labels) and controls severity, grace periods, and response actions.

Rules identify problems, while policies determine the response. Findings that violate an active policy become actionable issues and alerts, which feed into your overall compliance posture.

### How Rules and Policies work together

1. **Detect**: Cortex XSIAM evaluates rules against your cloud assets, workloads, and images to generate findings.
2. **Evaluate**: Findings are matched against active policies and their assigned scopes.
3. **Respond**: Findings that violate a policy (after any applicable grace periods) trigger alerts, create issues, or initiate blocking actions.
4. **Report**: Results aggregate into your overall compliance posture and reports.

### Types of Rules and Policies

Cortex XSIAM includes both built-in (out-of-the-box) and custom rules and policies.

| **Type**       | **Focus Area**                                                                            | **Key Capabilities & Frameworks**                                                                                                                                                                                                                                                                                                        |
| -------------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloud Security | Multi-cloud infrastructure posture (AWS, Azure, GCP, OCI)                                 | Covers CSPM, DSPM, CIEM, AISPM, and CNS. Findings map to CIS, NIST, PCI-DSS, SOC 2, and HIPAA frameworks. See [*Cloud security rules and policies*](/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies.md).                                                                                               |
| Cloud Workload | Compute workloads (VMs, Kubernetes clusters, hosts, container images, running containers) | Detects CVEs, malware, hard-coded secrets, and CIS benchmark violations. Policies let you set severity, grace periods, and enforcement actions (such as alerting or blocking noncompliant deployments). See [*Cloud workload policies and rules*](/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules.md). |
| Base Image     | Container base ("golden") images and image inheritance                                    | Identifies base images by repository, digest, name, or tag. Attributes vulnerabilities to specific layers to separate platform or DevOps issues from application-layer issues, and detects drift in running containers. See [*Base image rules*](/cortex-xsiam/cloud-security/rules-and-policies/base-images-rule.md).                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.