Generate issues from indicators using indicator rules for prevention and detection - Create detection and prevention rules using threat intelligence as a source. - Threat Intel Management Guide - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Select Inventory → Endpoints → Policy Management → Prevention → Profiles → Add Profile → Create New.

Select one of the following Platforms.

Select Restrictions.

From the Custom Indicator Prevention Rules section, in the Action Mode field, select Enabled.

You will see that there are no custom prevention rules defined. After you create an indicator rule, you will need to edit this profile and select the indicator rule.

Add the parameters as required. For more information, see Set up restrictions prevention profiles.

Create the Profile.

Select Threat Management → Detection Rules → Indicator Rules → Add Rule → Prevention Rule.

From the Create New Prevention Rule wizard, in the General section, add the following parameters:

Click Next.

In the Target section, use the filters and/or select the file indicators to which to apply the rule.

Click Next and then save the rule.

Go to Inventory → Endpoints → Policy Management → Prevention → Profiles.

Edit the Restrictions Profile you created in step 1.

In the Custom Indicator Prevention Rules tab, select the indicator rule you created in step 2.

Save the Profile.