Create a configuration rule - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Enter a Rule Name and Description.

Select a Severity. This will be the severity of any issues created with this rule.

(Optional) Add Labels. These rules can be used to find rules when creating custom policies.

(Optional) Enable Remediation using the toggle. In a later step, you'll enter the remediation instructions.

(Optional) Associate this rule with a Compliance Control. Click Add, select one or more custom compliance controls from the list, and then click Assign.

Custom configuration rules can only be associated with custom compliance controls.

Click Next.

Simple Mode: Presents a guided interface in which you can define basic conditions and address most common rule use cases.

Advanced Mode: Presents a free-form XQL editor that allows you to build complex and flexible queries across unrestricted datasets. Supports advanced and custom use cases.

Select options from the dropdown menus to define the logic for your config rule, such as “Find EC2 instances where accessKeys are allowed”, and then click Search to view all matching results.

Click Next to define Remediation instructions (if you had turned on Enable Remediation in the Overview step) or click Done.

Define an XQL query for the rule, following the guidelines in Guidelines for creating cloud security rules . For detailed XQL query instructions, see XQL Language Structure .XQL Language Structure

Click Test to determine if the query is valid.

Select the Affected Asset Type. Generated issues will be linked to assets identified by the selected field.

Check the list of query results to verify that the query is working as intended.

Click Next to define Remediation instructions (if you had turned on Enable Remediation in the Overview step) or click Done.