Example workflow: Modify an existing rule that manages all of the pre-built content provided by Trellix and then create a custom rule to cover other specific detections important to my organization.

You need to expand the rule coverage in your organization. One of the Trellix-provided rules would be ideal if you make some modifications. The modified rule is effective, but you realize you need coverage for other events specific to your organization. In this case, you must create a custom rule from scratch.

This workflow includes the following tasks:

Sort the Origin column on the Rules page to make it easier to find the Trellix rule you want to modify.
Select the Clone action to create an editable copy of the rule. See Modify a Trellix detection rule.
Modify the fields that should change. Then save the rule.
The rule is added to the Rules table as a custom rule.
Click Create Custom Rule on the Rules page to create a rule that provides additional coverage.
Configure and save the new rule. See Create a custom detection rule.
If you need to fine-tune the rule, select the Edit option and make the adjustments.