> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions.md).

# Issue exclusions

Exclude matching endpoint issues from investigation and case creation.

{% hint style="info" %}
**Required RBAC permissions**

* To view the **Issue Exception & Exclusion Rules** page you must have one of the following permissions:
  * At least **View** permission to **Exception Configuration > Issue Exclusions**.
  * View permission to **Exception Configuration > Exception Management Admin**.
* To create issue exclusions, you must have **View/Edit** permission **Exception Configuration > Issue Exclusions.**

For more information, see [Issue Exclusions permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md).
{% endhint %}

An Issue Exclusion is a rule that contains a set of issue match criteria for issues that you want to suppress in Cortex XDR. You can add an Issue Exclusion rule from scratch, or base the exclusion on issues that you investigate in a case. After you create an exclusion rule, Cortex XDR excludes the issues that match the criteria from cases and search query results, and no longer saves any of the matching issues that are generated in the future. If you select to apply the policy to historic results as well as future alerts, Cortex XDR displays the historic alerts as unavailable.

{% hint style="info" %}

### Note

* The agent continues to generate excluded issues on the endpoint, but they are not saved or displayed in Cortex XDR. Configuration of an issue exclusion does not remove or delete any of the logs that would have triggered the issue notification.
* You can also set up issue exceptions by creating global endpoint policy exceptions. For more information, see [Add a global endpoint policy exception](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md).
* Cortex XDR supports exclusion of up to 100,000 issues.
  {% endhint %}

### **Navigate to the Issue Exception & Exclusion Rules page**

The navigation path depends on your tenant configuration. Take one of the following paths:

* **Settings** →  **Issue Exception & Exclusion**
* **Settings** → **Exception Management** → **Issue Exception & Exclusion**

Open the **Exclusion Rules** tab to see all configured issue exclusion rules.

{% hint style="info" %}
This page also includes the Exception Rules tab. To view exception rules you must have at least **View** permission for **Exception Management Admin**.
{% endhint %}

#### Exclusion rules reference table

The following table describes both the default fields and additional optional fields that you can add to the exclusion rules table, and lists the fields in alphabetical order.

<table><thead><tr><th width="197">Field</th><th>Description</th></tr></thead><tbody><tr><td><img src="https://2127116976-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcyIgISZgANJYkmLlnwdK%2Fuploads%2Fgit-blob-c6b6b2f14c7423dbf3125f9808e33a5fb26dab66%2Ff694edc5fdec7b8486af9d1030915236cf771441aee4bab96ac21e7e4017f8bb.png?alt=media" alt="check-box.png"></td><td>Checkbox to select one or more issue exclusions on which you want to perform actions.</td></tr><tr><td>Backward Scan Status</td><td>Exclusion policy status for historic data, either enabled if you want to apply the policy to previous issues, or disabled if you don’t want to apply the policy to previous issues.</td></tr><tr><td>Comment</td><td>Administrator-provided comment that describes the purpose or reason for the exclusion policy.</td></tr><tr><td>Description</td><td>Text summary of the policy that displays the match criteria.</td></tr><tr><td>Modification Date</td><td>Date and time when the exclusion policy was created or modified.</td></tr><tr><td>Name</td><td>Descriptive name provided to identify the exclusion policy.</td></tr><tr><td>Policy ID</td><td>Unique ID assigned to the exclusion policy.</td></tr><tr><td>Status</td><td>Exclusion policy status, either enabled or disabled.</td></tr><tr><td>User</td><td>User that last modified the exclusion policy.</td></tr><tr><td>User Email</td><td>The administrative user's email address.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.