Disable legacy automation rules

omonroy502642 — Mon, 24 Aug 2026 14:52:06 GMT

Hello,

Currently in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.

Is there any way to disable them or replace them by using using auomation rules and/or playbooks?

Thanks for your help

Re: Disable legacy automation rules

susekar — Mon, 24 Aug 2026 21:23:27 GMT

Hello @omonroy502642 ,

Greetings for the day.

You can disable legacy automation rules and replace them with new Automation Rules and Playbooks.

1. Disable Legacy Automation Rules:

Migrated rules are moved to Simple Automation Rules (Legacy) or Issue Automations and are Read-Only.
Disable or delete legacy rules to stop automatic incident closures.
Once disabled, a rule cannot be re-enabled.
Legacy rules cannot be edited or newly created.
Once all legacy rules are deleted, the legacy page is removed.

2. Replace with New Automation Rules & Playbooks:

Review the legacy rule’s conditions and actions, then disable it.
Create a new rule in Automation Rules with the required conditions.
Use Quick Action for simple actions or Playbook for multi-step workflows.
Set priority and save.

3. Verify

Check Management Audit Logs or the incident War Room to confirm execution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: Disable legacy automation rules in Cortex XDR Discussions

Disable legacy automation rules

Re: Disable legacy automation rules

1. Disable Legacy Automation Rules:

2. Replace with New Automation Rules & Playbooks:

3. Verify