Add a Support Exception Rule - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product
Cortex XSIAM
Creation date
2024-05-06
Last date published
2024-07-17
Category
Administrator Guide
Abstract

How to add a support exception rule.

You can define and manage exceptions based on files received from the Customer Support team. You can apply the rule across all of your endpoints or to specific profiles.

Prior to Cortex XSIAM version 1.3, Support Exceptions were configured through profiles.

Starting with version 1.3, Cortex XSIAM enables you to manage the Support Exceptions from a central location and easily apply them across multiple profiles in the Support Exception Rules management page. 

To manage the prevention profile exceptions from Exception Configuration, you must first migrate your existing exceptions configured via the Prevention profiles.

Your migrated rules are displayed on the SettingsException ConfigurationsSupport Exception Rules page. For more information about the migration, see Exception Configuration.

Import Support Exception Rules File.

  1. From SettingsException ConfigurationSupport Exception Rules, click + Import from file.

  2. Drag and drop or browse for the JSON file you received from the Customer Support team.

  3. Select to apply the rule to specific Profiles or select Global to apply to all endpoints.

Important

If you don't migrate the legacy exceptions, you can continue to create exceptions through the profiles.