Disable Prevention Rule overview

The Disable Prevention Rule API lets you manage Disable Prevention rules in Cortex Cloud. These rules allow you to define specific exceptions to prevention actions enforced on endpoints.

You can apply Disable Prevention rules only to endpoints running Cortex XDR agent version 7.9 or later.

Using this API, you can:

• Retrieve existing Disable Prevention rules with support for filtering and pagination.
• Retrieve the list of available modules for a specified platform.
• Create new Disable Prevention rules to configure granular exceptions to endpoint prevention actions.
• Update existing Disable Prevention rules.
• Delete Disable Prevention rules by their IDs.

Required license: In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on.