A single-stage rule is standalone entity that matches n number of events over a given period of time. If the conditions of the rule are met, an alert is generated.
To create a single-stage rule from the Rules page:
From the main menu, select Configure > Rules.
Click Create Rule. The Create Rule dialog appears.
Supply the information in the table below.
Click Create Rule. The rule is saved.
Field
Description
Generate Alerts
This toggle, found on the Create Rule dialog, will determine whether or not the rule generates alerts and logs (when set to ON), or generates only logs (when set to OFF). This function is used primarily in multistage rules.
Enable Rule
This toggle, found at the top of the Create Rule dialog, determines whether or not the rule is active in your environment.
Name
The name of the rule.
Description
(Optional) Text description of the rule, which is displayed whenever this rule generates an alert. A description can include what it is looking for, information about the threat it is trying to detect, or other reference information.
Links
(Optional) You may add links for information or reference purposes. Links will be displayed whenever this rule generates an alert.
Tags
(Optional) You can add and remove tags from a rule. Tags can help you and other users organize and categorize rules. The tags you use in rules are not related to the tags used for custom dashboards.
Tag names can be up to 200 characters long. If you try to specify a tag that is larger than 200 characters, errors will result.
Rule Pack
(Optional) Select a rule pack to include the new rule. See Viewing and creating rule packs.
Confidence
Confidence can be set to low, medium, or high, and indicates how likely it is that the rule will detect events that correspond to the type of activity anticipated (that is, the likelihood that the rule will produce true positives). Confidence and Severity combine to form the risk attribute of the alert.
Severity
Severity can be low, medium, or high, and indicates how much of an impact a hit with this rule could have on an organization if verified to be a true positive. Confidence and Severity combine to form the risk attribute of the alert.
Query
When creating a rule from the Search box, the query will be the query used to find the search results. This query must be written using Rules TQL syntax.
Distinguisher
A field in an event that a rule uses to differentiate hits for the purpose of creating alerts. Typically, the distinguisher is a hostname or IP address, but it can be any field.
Threshold
The number of events matching a rule within the defined Window before an alert is raised.
Window
The amount of time for the defined Threshold to be met before an alert is raised.
Advanced: Assertions and dependencies are required only for multistage rules.
Assertions
Optional. For more information, see Assertions and dependencies.
Dependencies
Optional. For more information, see Assertions and dependencies.
: