**Prerequisite**: Creating a graph rule requires View or View/Edit RBAC permissions for Graph Search under **Investigation & Response → Search**.
The Graph Engine is a Cortex detection method that identifies threats by analyzing relationships between entities rather than evaluating individual events in isolation.\
The engine periodically queries a contextual security graph that represents your environment as:
* Nodes, such as identities, configurations, code repositories, data stores, and cloud resources.
* Edges and paths, which represent the relationships and access routes between those entities.\
Graph detection rules evaluate these relationships to identify risky combinations and potential attack paths. When a rule matches, the Graph Engine creates a live, evidence-backed issue in the Cortex issues experience.
Cortex includes predefined system Attack Path Graph rules. You can also create custom rules tailored to your organization’s environment and security requirements.
## Key characteristics
* **Detection type:** Graph-based detection that evaluates relationships and paths between entities.
* **Cyclic evaluation**: Graph rules run periodically rather than evaluating each event as it arrives. By default, the engine runs every 6 hours.
* **Path-based issue:** Each issue is uniquely identified by the rule ID and the graph path that triggered it. This allows the engine to track matching paths across evaluation cycles and automatically close issues generated by outdated rule versions.
* **Rule output**: The Graph Engine creates issues that appear in the Cortex issues experience.
## How to create a graph rule
To create a graph detection rule, navigate to **Posture Management → Rules & Policies → Rules → Cloud Security**.
1. Select **Create Rule → Graph**.
2. In the **New Graph Rule** page, under **General**, add the following details
* **Main Settings**:
* **Name**: A unique name for the rule.
* **Description**: A description of the rule.
* **Labels** (optional): Add labels to the rule.
* **Severity**: Select a severity level for the issue that will be triggered.
* **Remediation** (optional): Define Remediation instructions.
* **Compliance Controls** (optional): Select a control from the controls catalog.
4. In the **Condition** page, select the relevant options to build your query. The core logic for an attack path rule is built by selecting a primary asset and attaching Finding or Vulnerability conditions to it. For more information about how to build your graph query, see [Create Graph Search query](../../../reference-and-developer-docs/graph-search/create-graph-search-query). Use **Generate Preview** to see the results of your query.
5. In the **Summary** page, review the rule and click **Save**.
After the rule is synchronized and enabled, the Graph Engine evaluates it during the next scheduled cycle. An issue is created for each graph path that matches the rule conditions.