Manage endpoint prevention profiles - You can manage the endpoint prevention profiles of your Cortex XDR agent endpoints in various ways, including editing, duplicating, and populating endpoint prevention policy rules. - Administrator Guide - Cortex XSIAM - Cortex CLOUD

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the profile and select Edit.

Make your changes, and then click Save.

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the profile and select Export Profile.

Click Export. The profile is downloaded to your computer.

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the prevention profile and select Save as New. A new profile is displayed, containing the values from the profile that you selected.

Edit the profile name and description, edit any values that you want to change, and then click Create.

Populate a new prevention policy rule with your new profile.

If necessary, delete or detach any policy rules that use the profile before attempting to delete it.

From Inventory → Endpoints → Policy Management → Prevention → Profiles, locate the profile that you want to remove. The profile's Usage Count cell must have a 0 (zero) value.

Right-click the prevention profile and select Delete.

To confirm the deletion, click Yes.

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the profile and select Create a new policy rule using this profile.

Cortex Cloud automatically populates the Platform selection based on your profile configuration, and assigns the profile based on the profile type.

For Policy Name, enter a meaningful name, and optionally, add a description for the policy rule.

Assign any additional profiles that you want to apply to your policy rule, and click Next. A list of endpoints is displayed.

Select the target endpoints for the policy rule, or use the filters to define criteria for the policy rule to apply, and then click Next.

Review the policy rule summary, and then click Done.