topic Re: Disable legacy automation rules in Cortex XDR Discussions

Disable legacy automation rules

omonroy502642 — Mon, 24 Aug 2026 14:52:06 GMT

Hello,

Currently in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.

Is there any way to disable them or replace them by using using auomation rules and/or playbooks?

Thanks for your help

Re: Disable legacy automation rules

susekar — Mon, 24 Aug 2026 21:23:27 GMT

Hello @omonroy502642 ,

Greetings for the day.

You can disable legacy automation rules and replace them with new Automation Rules and Playbooks.

1. Disable Legacy Automation Rules:

Migrated rules are moved to Simple Automation Rules (Legacy) or Issue Automations and are Read-Only.
Disable or delete legacy rules to stop automatic incident closures.
Once disabled, a rule cannot be re-enabled.
Legacy rules cannot be edited or newly created.
Once all legacy rules are deleted, the legacy page is removed.

2. Replace with New Automation Rules & Playbooks:

Review the legacy rule’s conditions and actions, then disable it.
Create a new rule in Automation Rules with the required conditions.
Use Quick Action for simple actions or Playbook for multi-step workflows.
Set priority and save.

3. Verify

Check Management Audit Logs or the incident War Room to confirm execution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: Disable legacy automation rules

CJNTS — Fri, 16 Oct 2026 13:17:14 GMT

@susekar This menu does not exist. I created a support case and they are saying the same thing you say here. I have been looking for hours on how to disable XDR Automation (Legacy automation rules) and there is no apparent way to accomplish this. The only drop down option is "copy entire row" and I am an Account Admin.

Re: Disable legacy automation rules

CJNTS — Fri, 16 Oct 2026 13:22:33 GMT

Did you figure out how to disable the legacy automation rules?

Re: Disable legacy automation rules

omonroy502642 — Fri, 16 Oct 2026 13:37:51 GMT

After some time TAC replied:

a. Left-click the rule row once to select it.
b. Press the SPACEBAR on your keyboard to highlight the row.
c. Right-click the highlighted row; the full menu with "Disable" and "Delete" will appear.
Select "Disable" or "Delete". Please note that once a legacy rule is disabled, it cannot be re-enabled.

Hope it works for you

Re: Disable legacy automation rules

CJNTS — Fri, 16 Oct 2026 13:42:49 GMT

YOU'RE MY BOY MONROY!