> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-rules-for-issue-layouts.md).

# Create rules for issue layouts

Issue layouts are applied to issues according to layout rules. Using a layout rule, you can assign a custom issue layout based on the issue source, such as a specific layout for issues generated from a correlation rule.

You can create multiple rules. If the first rule does not apply to the incoming issue, the next rule is checked, and so on. If a content pack is installed and it contains a layout rule, by default the layout rule is placed at the top of the rules list. You can change the order of the rules by dragging and dropping the rules in the list. You can filter the rule list by name, description, rule, layout, and source. If no layout rules apply to the issue, a default issue layout is used.

To edit or delete existing rules, right-click on the rule in the list and select Edit or Delete.

### How to create layout rules

1. Go to Settings → Configurations → Object Setup → Issues → Layout Rules → New Rule.
2. Enter a rule name, select the layout to use if the rule is met, and provide a description.
3. Search for issues that match the criteria you want to use for the layout rule. For example, you can search for issues from a specific issue source.
4. Click Create.
5. Repeat as needed to create multiple rules.
6. Click Save.

### **SBAC considerations**

Layout rules support SBAC (scoped based access control). The following parameters are considered for editing access.

* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to restrictive mode, you can edit a rule if you are scoped to all tags in the rule.
* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to permissive mode, you can edit a rule if you are scoped to at least one tag listed in the rule.
* As a scoped user who has editing permissions to a rule, you can change the order among other rules that are locked.
* If a rule was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-rules-for-issue-layouts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.