---
title: "Tune Trellix rules"
slug: "tune-trellix-rules-new"
updated: 2026-10-16T11:26:17Z
published: 2026-10-16T11:01:53Z
canonical: "docs.trellix.com/tune-trellix-rules-new"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tune Trellix rules

Rule tuning allows you to adjust the detection logic of a Trellix rule without creating a new custom rule. A tuned rule retains the original Trellix rule ID. Helix visually distinguishes tuned conditions from the original Trellix conditions.

The definition fields are read-only. These fields include Rule ID, Tenant ID, Name, and Description. To modify these fields, you must clone the rule.

> [!NOTE]
> Note
> 
> You can override the Severity field from the Settings panel without cloning the rule.

Helix records tuning changes on the History tab of the rule. The history record includes the specific change, the user who made the change, and the timestamp.

### Tunable rule settings

You can tune a rule using the condition editor and the Settings panel. What you can tune depends on the rule structure.

| Rule type | What you can tune |
| --- | --- |
| Single-condition rule | Append to the match condition. Adjust the Threshold and Window. |
| Correlated rule | Append the match conditions at any level. You cannot change how conditions correlate. However, you can add or edit the **Threshold** or **Window**. |

You can modify the rule settings in the Settings panel:

1. Go to the Rules (New) page.
2. Select the applicable rule and select the options menu (⋮) at the end of the row.
3. Click Edit.
4. In the Settings panel, modify the following options as required.

- Status: Select Enabled, Disabled, Muted, or Deleted.
- Severity Override
- **Exclude these lists**
- Tags: You can add custom tags. Trellix Assigned Tags are read-only.

### Tune a rule

Trellix rules detect broad classes of threats. However, normal activity in your environment can trigger irrelevant alerts. You can tune a Trellix rule to adjust its detection logic to fit your environment, or clone it into a new custom rule. Tuned rules retain their original Trellix rule ID and receive ongoing content updates. Cloned rules become separate custom rules that Trellix does not maintain.

Tune rules to maintain a manageable alert flow and save time for SOC analysts. This section describes methods to improve the signal-to-noise ratio for Trellix rules.

Follow these steps to tune a rule in Helix.

1. Go to the Rules (New) page.
2. Locate the Trellix rule that you want to tune.
3. Select the options menu at the end of the row, and then select Edit.
4. Turn on the Tune toggle above the condition editor.
5. Update the condition. You can edit or add a match filter, threshold, and within (time window) value for the condition. For a correlated rule, the editor highlights the specific condition you're updating or appending to.
6. Update the options in the Settings panel.
7. Select Save.
8. To revert tuning, select the options menu (⋮) next to the Tune toggle.
9. Select one of the following options.
  - Select Reset to last saved to undo changes made since your last save.
  - Select Reset to original Trellix rule to discard all tuning and restore the original settings.