> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicator-rules.md).

# XTI indicator rules

Use XTI indicator rules to monitor your environment for known threat indicators—such as malicious IPs, domains, and file hashes. Configure an indicator rule to scan collected log data and generate an issue for investigation upon a match.

XTI indicator rules offer smart, dynamic targeting. In addition to manually selecting static lists of indicators, you can build dynamic, attribute-based filters using rich threat intelligence context. For example, you can create a rule that automatically targets "all indicators linked to a specific threat actor with a malicious verdict". As new intel is ingested that matches your filters, the rule dynamically updates its scope without manual intervention.

## Indicator rule limits

* Each tenant is limited to a maximum of 4 million indicators flagged by indicator rules.
* The maximum number of indicators allowed per rule depends on the scoping mechanism used (static list or dynamic filter). Rules using static lists support up to 1,000 indicators, while rules using dynamic filters can support up to 1 million indicators. If you require a higher limit, reach out to Palo Alto Networks.

## Supported indicator rule types

Currently, only detection rules are supported.

You can create a detection rule using a static list of manually selected indicators or a dynamic filter that automatically adds new indicators to the rule based on the filter conditions.

## Permissions required for using indicator rules

Viewing indicator rules requires **View** RBAC permissions for both **Threat Intelligence** and **Rules** in the **Threat Management** component tab.

Creating, modifying, enabling/disabling, and deleting indicator rules requires **View** or **View/Edit** RBAC permissions for both **Threat Intelligence** and **Rules** in the **Threat Management** component tab.

## View indicator rules

To view and manage indicator rules, go to **Threat Management → Detection Rules → Indicator Rules**. For each rule, you can see: Modification Date, Name, Type, Target, Severity, # of Issues, Created by, Description, Status, Rule ID, and Creation Date.

## Create an indicator rule for detection

To create a detection rule:

1. Go to **Threat Management → Detection Rules → Indicator Rules**.
2. Select **+Add Rule**.
3. In the **Overview**, provide:
   1. **Rule Name**: The rule name is used when creating issues triggered by the rule (The title and description of an issue will include the rule name and the indicator value). The rule name can include up to 75 characters; no special characters are allowed.
   2. **Severity** (Critical, High, Medium, or Low): The severity of an indicator rule determines the severity of issues created as a result of rule matching. Severity also dictates rule priority. If two rules flag the same indicator, the rule with the highest severity is associated with the indicator and the corresponding issue. If two rules have the same severity, the last modified rule has priority.
   3. **Description** (Optional).
4. Select **Next**.
5. In the **Select Target Indicators**, select one of the following.
   1. **Static List**: Manually select indicators one by one. You can select up to 1000 indicators.
   2. **Dynamic Filters**: Specify a filter. The filter automatically adds new indicators to the rule based on the filter conditions, up to 1 million indicators per rule.
6. Select **Next**.
7. Confirm the details and select **Create New Rule** to save the rule.

## Modify an indicator rule

You can modify a previously created indicator rule to update future detections. All parameters can be modified.

Note: Changes take effect going forward and do not apply retroactively. Existing issues are not closed or updated after a rule modification.

To modify a previously created rule:

1. Go to Threat Management → Detection Rules → Indicator Rules.
2. Right-click a rule and then select Edit Rule.

## Enable or disable an indicator rule

You can enable or disable indicator rules.

{% hint style="info" %}
Disabling a rule stops new rule matching but does not close previously generated issues.
{% endhint %}

To enable or disable a rule:

1. Go to **Threat Management → Detection Rules → Indicator Rules**.
2. Right-click a rule and then select **Disable Rule** or **Enable Rule**.
3. Confirm by selecting **Yes**.

## Delete an indicator rule

You can delete a previously created indicator rule to prevent future detections. Deleting an indicator rule cannot be reverted.

Note: Existing issues generated by the rule are not closed after you delete the rule.

To delete a rule:

1. Go to **Threat Management → Detection Rules → Indicator Rules**.
2. Right-click a rule and then select **Delete Rule**.
3. Confirm by selecting **Delete**.

\ <br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicator-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.