Benefits of using custom detection rules

You can customize certain settings in a Trellix rule and save the rule. The saved rule remains a Trellix rule; it does not become a new custom rule. These settings allow you to enable or disable the rule, override the default severity level, select a task to run when the rule is triggered, assign tags to the rule, and create and specify lists of exclusions.

Cloning a rule and editing it instead of creating a rule from scratch saves you time and effort. The cloned rule is a new custom rule that is populated with data from the original rule. You can clone both Trellix rules and custom rules.

Exclusions and exclusion lists reduce noise and false positives, and reduce the need to create complex conditions. For example, you could have a list of IPv4 addresses that should not trigger an alert. The detection engine will ignore any IP address in the list that maps to a srcipv4 value in an event.

Rules that are too broad in scope can trigger excessive alerts. The detection engine automatically disables rules that are too noisy.