How policies and rules work together

Understand how Cortex XSIAM cloud workload rules detect violations and policies create issues or apply preventive actions.

Cloud Workload Policies serve as enforcement mechanisms that govern the responses to the identified findings, whereas Cloud Workload Rules establish the criteria for evaluation but do not initiate any actions unless incorporated within a policy.

In the absence of an associated policy, rules exist solely as evaluative criteria and do not generate alerts or trigger any response actions. Policies determine how findings from rules are escalated to issues or preventive measures.