Create a new prevention policy rule for serverless function

Create Cortex XSIAM prevention policy rules for serverless functions.

1

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the profile and select Create a new policy rule using this profile.

Cortex XSIAM automatically populates the Platform selection based on your profile configuration as well as the Restricitons selection with the selected profile.

2

For Policy Name, enter a meaningful name, and optionally, add a description for the policy rule, and then click Next.

3

Use the filters to define criteria for the policy rule to apply, and then click Next.

Select from the following function parameters:

• Cloud provider

• Region

• Runtime

• Function version

• Endpoint name

4

Review the policy rule summary, and then click Done.

The filter is stored within the policy definition and assessed during runtime to extract the functions that match the filter criteria.