Alerting: Step 1. Name and Describe the Rule

Document created by RSA Information Design and Development on Apr 22, 2016
Version 1Show Document
  • View in full screen mode
 
  

This topic provides instructions to identify a rule, indicate if it is a trial rule and assign a severity level. When you add a new rule, the first information to provide is a unique name and description of what the rule detects. After you save the rule, this information is displayed in the Rule Library. 

Prerequisites

You must have permission to manage rules. See Role Permissions.

Procedure

To name and describe a rule:

  1. In the Security Analytics menu, select Alerts > Configure > Rule
  2. In the Rule Library, select addList.PNG > Rule Builder.
    The New Rule tab is displayed.
    RBTopBlank.png
  3. Type a unique, descriptive name in the Rule Name field.
    This name will appear in the Rule Library so be specific enough to distinguish the rule from others.
  4. In the Description field, explain which events the rule detects.
    The beginning of this description will appear in the Rule Library
  5. Select Trial Rule to automatically disable the rule if all trial rules collectively exceed the memory threshold. 
    Use trial rule mode as a safeguard to see if a rule runs efficiently and to prevent downtime caused by running out of memory. For more information, see Work with Trial Rules.
  6. For Severity, classify the rule as Low, Medium, High or Critical.
You are here: Add Rules to the Rules Library > Add a Rule Builder Rule > Step 1. Name and Describe the Rule

Attachments

    Outcomes