You can view Trellix and customer rule packs on the Rule Packs page. The table on the page contains two tabs: one for Trellix Rule Packs and one for Customer Rule Packs.
To view the rule packs in your environment:
From the main menu, select Configure > Rule Packs.
The following information is provided for each rule pack in the rule pack table. The information varies slightly depending on which tab is selected.
Rule pack information | Description |
|---|---|
ID | The unique ID assigned to the rule pack when it was created. |
Name | The name of the rule pack. |
Coverage | This field appears on the Trellix Rule Packs tab only. It shows the percentage of rules within the rule pack for which you are collecting data. Two values are shown in this column:
For example, if 10 enabled Trellix rules are in a rule pack and 5 of them reference data that is currently collected and sent to Trellix Helix, 50% of the rules have coverage. The following appears in the column for the rule pack: |
Enabled | The number of rules within the rule pack that are enabled. |
Disabled | The number of rules within the rule pack that are disabled. |
Click For Trellix rule packs, you can:
For customer rule packs, you can:
|
.png "kebab_icon.png")