List Rules¶
Rules List¶
Purpose¶
The Rules module helps manage rules (XML/JSON) used for log analysis and anomaly event detection, as well as decoders to correctly understand log formats from many different sources.
Features¶
- List rules with information:
ID,Description,File Name,Rule Level,Group,Mitre,Status. - View rule content
Rules are a set of condition rules written in XML that define how alerts are pushed to the Portal.
Main Columns¶
| Column | Description |
|---|---|
| ID | Unique identifier of the rule |
| Description | Description of rule content, example: detect Suricata alert, SSH failed login, etc... |
| File Name | XML/definition file |
| Rule Level | Alert level (usually 0-15); higher means more severe |
| Group | Group related to event/log type (e.g.: suricata, syslog, ssh) |
| Mitre | Usually used to map rules to MITRE ATT&CK framework. |
| Status | Rule status: enabled or disabled. |
Rule Management¶
- Filter by Sensor, Rule Level, Group, Mitre.
- Disable rules to reduce noise.
- Create custom rules when needing to detect specific behaviors.