It may be necessary to tailor an existing rule to meet your needs. There are three ways to tailor detection rules for your organization:
Modify Trellix rules. You cannot change the rule definition, but can modify certain settings. See Modify a Trellix detection rule.
Create custom detection rules. See Create a custom detection rule.
Clone and modify custom or Trellix rules. The cloned rule is an exact duplicate of the original rule that you can modify and save. See Clone a rule.