https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/disable-legacy-automation-rules/m-p/1262674#M9516 <P>Hello,</P> <P>&nbsp;</P> <P>Currently&nbsp; in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.</P> <P>&nbsp;</P> <P>Is there any way to disable them or replace them by using using auomation rules and/or playbooks?</P> <P>&nbsp;</P> <P>Thanks for your help</P> Mon, 24 Aug 2026 14:52:06 GMT omonroy502642 2026-08-24T14:52:06Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/disable-legacy-automation-rules/m-p/1262674#M9516 <P>Hello,</P> <P>&nbsp;</P> <P>Currently&nbsp; in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.</P> <P>&nbsp;</P> <P>Is there any way to disable them or replace them by using using auomation rules and/or playbooks?</P> <P>&nbsp;</P> <P>Thanks for your help</P> Mon, 24 Aug 2026 14:52:06 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/disable-legacy-automation-rules/m-p/1262674#M9516 omonroy502642 2026-08-24T14:52:06Z