Disable legacy automation rules

[omonroy502642]

Hello,

Currently  in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.

Is there any way to disable them or replace them by using using auomation rules and/or playbooks?

Thanks for your help

[susekar]

Hello @omonroy502642 ,

Greetings for the day.

You can disable legacy automation rules and replace them with new Automation Rules and Playbooks.

1. Disable Legacy Automation Rules:

• Migrated rules are moved to Simple Automation Rules (Legacy) or Issue Automations and are Read-Only.
• Disable or delete legacy rules to stop automatic incident closures.
• Once disabled, a rule cannot be re-enabled.
• Legacy rules cannot be edited or newly created.
• Once all legacy rules are deleted, the legacy page is removed.
  
  

2. Replace with New Automation Rules & Playbooks:

• Review the legacy rule’s conditions and actions, then disable it.
• Create a new rule in Automation Rules with the required conditions.
• Use Quick Action for simple actions or Playbook for multi-step workflows.
• Set priority and save.
  
  

3. Verify

• Check Management Audit Logs or the incident War Room to confirm execution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar