Cortex Policy or Rule Modification

Collin Lairamore@Bollinmore

•updated May 31, 2026•8•1•27

This rule detects modifications to Cortex prevention policies or detection rules. Specifically, it looks for creation, editing, or deletion of policy profiles, and editing, reordering, or reverting of prevention policy rules. Authorized personnel can be added to the email filter and this rule can serve as a detection for unauthorized tampering.