Disable legacy automation rules

[omonroy502642]

Hello,

Currently  in our xdr tenant, many issues have been getting automatically closed by legacy automation rules, rules migrated from XDR v3.x to v5,x. The problem is that these rules have conditions such as, category=Malware and detection method = XDR Agent whichr esults in legitimate security incidents being closed without analyst review.

Is there any way to disable them or replace them by using using auomation rules and/or playbooks?

Thanks for your help

[susekar]

Hello @omonroy502642 ,

Greetings for the day.

You can disable legacy automation rules and replace them with new Automation Rules and Playbooks.

1. Disable Legacy Automation Rules:

• Migrated rules are moved to Simple Automation Rules (Legacy) or Issue Automations and are Read-Only.
• Disable or delete legacy rules to stop automatic incident closures.
• Once disabled, a rule cannot be re-enabled.
• Legacy rules cannot be edited or newly created.
• Once all legacy rules are deleted, the legacy page is removed.
  
  

2. Replace with New Automation Rules & Playbooks:

• Review the legacy rule’s conditions and actions, then disable it.
• Create a new rule in Automation Rules with the required conditions.
• Use Quick Action for simple actions or Playbook for multi-step workflows.
• Set priority and save.
  
  

3. Verify

• Check Management Audit Logs or the incident War Room to confirm execution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[CJNTS]

@susekar This menu does not exist. I created a support case and they are saying the same thing you say here. I have been looking for hours on how to disable XDR Automation (Legacy automation rules) and there is no apparent way to accomplish this. The only drop down option is "copy entire row" and I am an Account Admin. 

[CJNTS]

Did you figure out how to disable the legacy automation rules?

[omonroy502642 · Accepted solution]

After some time TAC replied:

a. Left-click the rule row once to select it.
b. Press the SPACEBAR on your keyboard to highlight the row.
c. Right-click the highlighted row; the full menu with "Disable" and "Delete" will appear.
Select "Disable" or "Delete". Please note that once a legacy rule is disabled, it cannot be re-enabled.

Hope it works for you

[CJNTS]

YOU'RE MY BOY MONROY!