Create a new prevention policy rule for serverless function ↗

From Inventory → Endpoints → Policy Management → Prevention → Profiles, right-click the profile and select Create a new policy rule using this profile.

Cortex XSIAM automatically populates the Platform selection based on your profile configuration as well as the Restricitons selection with the selected profile.

For Policy Name, enter a meaningful name, and optionally, add a description for the policy rule, and then click Next.

Use the filters to define criteria for the policy rule to apply, and then click Next.

Select from the following function parameters:

• Cloud provider
• Region
• Runtime
• Function version
• Endpoint name

Review the policy rule summary, and then click Done.

The filter is stored within the policy definition and assessed during runtime to extract the functions that match the filter criteria.