Creating a multistage rule (Legacy)

To create a rule in a multistage rule:

From the main menu, select Configure > Rules.
Click Create Rule. The Create Rule dialog appears.

Supply the following information on the Create Rule dialog:

Field	Description
Generate Alerts	This toggle, found on the Create Rule dialog, will determine whether or not the rule generates alerts and logs (when set to ON), or generates only logs (when set to OFF). This function is used primarily in multistage rules.
Enable Rule	This toggle, found at the top of the Create Rule dialog, determines whether or not the rule is active in your environment.
Name	The name of the rule.
Description	(Optional) Text description of the rule, which is displayed whenever this rule generates an alert. A description can include what it is looking for, information about the threat it is trying to detect, or other reference information.
Links	(Optional) You may add links for information or reference purposes. Links will be displayed whenever this rule generates an alert.
Tags	(Optional) You can add and remove tags from a rule. Tags can help you and other users organize and categorize rules. The tags you use in rules are not related to the tags used for custom dashboards. Tag names can be up to 200 characters long. If you try to specify a tag that is larger than 200 characters, errors will result.
Rule Pack	(Optional) Select a rule pack to include the new rule. See Viewing and creating rule packs.
Confidence	Confidence can be set to low, medium, or high, and indicates how likely it is that the rule will detect events that correspond to the type of activity anticipated (that is, the likelihood that the rule will produce true positives). Confidence and Severity combine to form the risk attribute of the alert.
Severity	Severity can be low, medium, or high, and indicates how much of an impact a hit with this rule could have on an organization if verified to be a true positive. Confidence and Severity combine to form the risk attribute of the alert.
Query	When creating a rule from the Search box, the query will be the query used to find the search results. This query must be written using Rules TQL syntax.
Distinguisher	A field in an event that a rule uses to differentiate hits for the purpose of creating alerts. Typically, the distinguisher is a hostname or IP address, but it can be any field.
Threshold	The number of events matching a rule within the defined Window before an alert is raised.
Window	The amount of time for the defined Threshold to be met before an alert is raised.
Advanced: Assertions and dependencies are required only for multistage rules.
Assertions	Optional. For more information, see Assertions and dependencies.
Dependencies	Optional. For more information, see Assertions and dependencies.

Click Advanced at the bottom of the Create Rule dialog.
Create assertions and dependencies, as appropriate for the stage of the rule in the multistage rule. See Multistage rule workflow and Assertions and dependencies.
- If this is a first-stage rule, it must have at least one assertion, but no dependencies.
- If this is a middle-stage rule, it must have at least one assertion and at least one dependency.
- If this is a final-stage rule, it must have at least one dependency and no assertions.
See Assertions and Dependencies.
After appropriate assertions and dependencies have been defined, click Create Rule. The rule is saved.

Important

When the multistage rule is satisfied, a class=analytics application='multi-stage rules' event is created.

If you want to generate alerts for the multistage rule, you must create another rule that matches on this analytics event. For example, if the final-stage rule has a rule ID of 9999.0.1, the query for the alerting multistage rule would be:

class=analytics application='multi-stage rules' detect_ruleids:9999.0.1