Alerting: Step 1. Name and Describe the Rule

Document created by RSA Information Design and Development on Jul 20, 2016Last modified by RSA Information Design and Development on Apr 26, 2017
Version 2Show Document
  • View in full screen mode
  

This topic provides instructions to identify a rule, indicate if it is a trial rule and assign a severity level. When you add a new rule, the first information to provide is a unique name and description of what the rule detects. After you save the rule, this information is displayed in the Rule Library. 

Prerequisites

You must have permission to manage rules. See Role Permissions.

Procedure

To name and describe a rule:

  1. In the Security Analytics menu, select Alerts > Configure > Rule
  2. In the Rule Library, select addList.PNG > Rule Builder.
    The New Rule tab is displayed.
    RBTopBlank.png
  3. Type a unique, descriptive name in the Rule Name field.
    This name will appear in the Rule Library so be specific enough to distinguish the rule from others.
  4. In the Description field, explain which events the rule detects.
    The beginning of this description will appear in the Rule Library
  5. By default, new rules are configured as a Trial Rule. A trial rule automatically disables the rule if all trial rules collectively exceed the memory threshold. If you are editing an existing rule, you can select Trial Rule to safely test the rule edits.
    Use trial rule mode as a safeguard to see if a rule runs efficiently and to prevent downtime caused by running out of memory. For more information, see Work with Trial Rules.
  6. For Severity, classify the rule as Low, Medium, High or Critical.
You are here
Table of Contents > Add Rules to the Rules Library > Add a Rule Builder Rule > Step 1. Name and Describe the Rule

Attachments

    Outcomes