> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-network-exposure-rule-for-serverless-functions.md).

# Create a network exposure rule for serverless functions

Network Exposure rules allow you to monitor and control the network accessibility of your serverless functions, identifying configurations that might expose them to unwanted external traffic.

1. Under **Posture Management**, select **Rules & Policies** → **Cloud Security (under Rules)** → **click Create Rule**.
2. Select **Network Exposure**.
3. On the **Overview** step of the **Create Network Exposure Rule** wizard.
   1. Fill in these fields:
      * **Rule Name**: (required): A user-provided to identify the rule
      * **Description** (required): A description of the rule
      * **Severity** (required): Select the severity level. Only findings with this exact severity level will trigger this rule. Findings with different severity levels will be ignored
      * **Labels**: (optional): Assign labels to categorize and organize the rule based on specific criteria or attributes. Labels help in easily identifying and filtering rules
   2. Click Next.
4. Define the logic for the rule on the **Rule Logic** step of the wizard.
   1. Fill in these fields:
      * **Source Network**: Select the source network to be evaluated by this rule. Options:
        * **Untrusted** (default): all internet IPs
        * A specific IP or CIDR range: Select **Show Advanced Settings** and fill in the following fields:
          * **Protocol/Port**: Specify the protocols and ports that will generate findings if exposed. For example: tcp/80, tcp/20-23, tcp/80, tcp/443
          * **Host State**: Configure the rule to alert on either active (running) or potentially exposed (stopped) workloads
          * **Use External Probe Validation**: When enabled, network scanning verifies internet exposure and provides additional context (protocols, ports, services). Disabling it relies on configuration alone, which may increase inaccurate findings
      * **Destination Asset Type**: Select **Serverless Function** as the asset type to be evaluated in the rule
      * **Cloud Service Provider**: Select the target cloud provider in which the rule will be evaluated (AWS, GCP, Azure)
   2. Click Done.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-network-exposure-rule-for-serverless-functions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.