Parsing Rules Editor Views

The Parsing Rules editor contains three views — User Defined Rules, Default Rules, and Both.
Parsing Rules requires a Cortex XDR Pro per TB license.
The Parsing Rules editor contains three views.
When there are any Parsing Rules errors to report, the Parsing Rules editor displays these errors at the bottom of the editor in a section called
List of Errors
. Otherwise, this section is not displayed. For more information, see Error Reporting in Parsing Rules.
  • User Defined Rules
    (default)—Displays an editor for writing your own custom parsing rules that override the default rules.
  • Default Rules
    —Displays the parsing rules that are provided by default with Cortex XDR in read-only mode.
  • Both
    —Side-by-side view of both the
    User Defined Rules
    Default Rules
    , so you can easily view the different rules in one screen.

Recommended For You