This topic explains how to configure parameters in an RSA Live ESA rule. When you download an RSA Live ESA rule, the rule appears in the Rule Library which includes the following columns:
- Trial Rule
The type is RSA Live ESA Rule.
- Administrator, Operator, SOC Manager or DPO role permissions are required.
- Rules must be downloaded to the Rule Library.
To customize an RSA Live ESA rule:
- In the Security Analytics menu, select Alerts > Configure > Rule.
- In the Rule Library, select an RSA Live ESA Rule and click .
The RSA Live ESA Rule tab is displayed.
- (Optional) Change the following fields:
- Rule Name
- Trial Rule (Enabled by default. RSA recommends you run a rule as a trial rule long enough to assess the performance during normal and peak network traffic.)