> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/alerts/create-an-alert-rule-cloud-workloads.md).

# Create an Alert Rule for Cloud Workloads

If you want to generate alerts for [cloud workload policies](/content-collections/governance/workload-protection-policies.md), use alert rules to define the target cloud accounts and policies for which you want to generate alerts and send notifications to an external destination.

1. Create a Resource List for Compute Access Group.

   Select **Settings > Resource Lists > Add Resource List**. See [Compute Access Group](/content-collections/administration/add-a-resource-list-on-prisma-cloud.md).
2. Create an alert rule.
   1. Select \*Alerts > Alert Rules > Add Alert Rule".
   2. Add a Name.

      Auto-remediation is not supported for Workload Incident and Workload Vulnerability policy. For details on the other optional settings, see [Automations](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md).
   3. Select **Compute Access Group** and choose one ore more to assign to this rule.

      <figure><img src="/files/BetXlWt9owpWhXAeuGRK" alt="view compute access group"><figcaption></figcaption></figure>
   4. Assign policies.

      Only Workload Vulnerability and Workload Incident policies are available for Compute Access Groups. To include other policy types, see [run-time checks for other resources](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md).

      <figure><img src="/files/wEaahtZ0MhbMXKEAuSh0" alt="assign workload policies"><figcaption></figcaption></figure>
   5. Review the summary and save your changes.
3. Verify that the alert rule is working.

   You must have the Defender installed on the host or container image.

   1. Check for issues on a host or container image.

      To check any vulnerabilities on a host, select **Runtime Security > Monitor > Vulnerabilities > Hosts**. Find the host name and review the details in the **Vulnerabilities** column .

      <figure><img src="/files/7GjaNkUXIW7zqyL0FvgQ" alt="verify cag alert rule 1"><figcaption></figcaption></figure>
   2. Check for alerts.

      Select **Alerts > Overview**, and set the Policy Type filter to **Workload Vulnerability** and **Workload Incident**.

      <figure><img src="/files/QrcdADNm2qtEG7XXqOeN" alt="verify cag alert rule 2"><figcaption></figcaption></figure>

      View the vulnerabilities count details for the violating resources.

      <figure><img src="/files/YrPxvw52TFzEcCkWN64j" alt="verify cag alert rule 3"><figcaption></figcaption></figure>

## Filter for Alerts Related to Workload Policies

After you create an alert rule, when a policy violation occurs, you can view the alert for the workload incidents and vulnerabilities along with all the other policies that detect run-time issues on the Prisma Cloud console.

1. Select **Alerts > Overview**.
2. Set the Filters for the alerts related to workload policies.

   Most of the filters are easy to interpret and use. The following include specific for viewing alerts related to workloads, such as container images or hosts, that do not belong to cloud accounts which are onboarded on Prisma Cloud.

   * Cloud Account—Name of the cloud account if account is onboarded on Prisma Cloud; Choose **None** to filter on-premises workload resources.
   * Cloud Account ID—Cloud Account ID of the cloud account if account is onboarded on Prisma Cloud; Choose **None** to filter on-premises workload resources.
   * Cloud Service, Cloud Region, Cloud Type—Choose **Other** to filter container workloads.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/alerts/create-an-alert-rule-cloud-workloads.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.