Manage automation rules - Manage your automation rules. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

If you migrated from Cortex XDR to Cortex XSIAM, you can still run existing automation rules but you can not edit them or add new rules. You can disable and delete the rules, as required. To see your existing automation rules, go to Incident Response → Response → Automation → Automation Rules.

To set up new automations, you can create playbooks, or use the playbooks provided by Cortex XSIAM. For more information, see What is a playbook?.