Respond Config: Incident Rule Details View

Document created by RSA Information Design and Development on Mar 2, 2018Last modified by RSA Information Design and Development on Mar 27, 2018
Version 3Show Document
  • View in full screen mode

The Incident Rule Details view enables you to create and edit incident rules for creating incidents from alerts. This topic describes the information required when creating or editing a new rule.

Note: The information in this topic applies to RSA NetWitness® Suite Version 11.1 and later.

What do you want to do?

RoleI want to ...Show me how
Analyst, Content Expert, SOC ManagerEnable, create, or edit an incident rule.Step 3. Enable and Create Incident Rules for Alerts
Analyst, Content Expert, SOC ManagerSet up and use the User Behavior default rule.
Set up or verify the preconfigured (default) incident rules.
Set Up and Verify Default Incident Rules
Incident Responders, Analysts, Content Experts, SOC ManagerView the results of my incident rule (View Detected Threats).See "Responding to Incidents" in the NetWitness Respond User Guide.

Related Topics

Incident Rule Details View

To access the Incident Rule Details view, do one of the following:

  • To create a rule, go to CONFIGURE > Incident Rules and click Create Rule.

  • To edit a rule, go to CONFIGURE > Incident Rules and click the link in the Name column for the rule that you want to update.

    The Incident Rule Details view is displayed. The following figure shows the Incident Rule Details view in Rule Builder query mode.

    Incident Rule Details View - Rule Builder query mode
    In the Match Conditions section, if you select Advanced query mode, a field to enter advanced queries is available as shown in the following figure.

    Incident Rules Detail view - Advanced Query

The following table describes the options available when creating or editing incident rules.

Section Field Description



Select to enable the rule.


Name of the rule. This is a required field.


A description of the rule to indicate which alerts get aggregated.



Rule Builder: Select the Rule Builder option if you want to build a query with various conditions that can be grouped. You can also have nested groups of conditions.

In the Match Conditions, you can set the value to All of these, Any of these, or None of these. Depending on what you select, the criteria types specified in the Conditions and Group of conditions are matched to group the alerts.

For example, if you set the match condition to All of these, alerts that match the criteria mentioned in the Conditions and Group Conditions are grouped into one incident.

  • Add a Condition to be matched by clicking the Add Condition button.
  • Add a Group of Conditions by clicking the Add Group button and add conditions by clicking the Add Condition button.

You can include multiple Conditions and Groups of Conditions that can be matched as per criteria set and group the incoming alerts into incidents.


Advanced: Select the Advanced query option if you want to use the advanced query builder. You can add a specific condition that needs to be matched as per the matching option selected.

For example, you can type the criteria builder format {"$and": [{"alert.severity" : {"$gt":4}}]} to group alerts that have severity greater than 4.

For advanced syntax, refer to or



Group into an Incident: If enabled, the alerts that match the criteria set are grouped into an alert.

Suppress the Alert: If enabled, the alerts that match the criteria are suppressed.



The criteria to group the alerts as per the specified alert fields. You can use a maximum of two fields to group the alerts. You cannot group alerts with fields that do not have values.
Grouping on an alert field means that all matching alerts containing the same meta key value for that field are grouped together in the same incident. (See the following Group By Meta Key Mappings table.)


The time range specified to group alerts.
For example, if the time window is set to 1 hour, all alerts that match the criteria set in the Group By field and that arrive within an hour of each other are grouped into an incident.



Title of the incident. You can provide placeholders based on the attributes you grouped. Placeholders are optional. If you do not use placeholders, all Incidents created by the rule will have the same title.

For example, if you grouped them according to the source, you can name the resulting Incident as Alerts for ${groupByValue1}, and the incident for all alerts from NetWitness Endpoint would be named Alerts for NetWitness Endpoint.


(Optional) Summary of the incident created by this rule.


(Optional) Category of the incident created. An incident can be classified using more than one category.


(Optional) Name of the user assigned to the incident.

Average of Risk Score across all of the Alerts: Takes the average of the risk scores across all the alerts to set the priority of the incident created.

Highest Risk Score available across all of the Alerts: Takes the highest score available across all the alerts to set the priority of the incident created.

Number of Alerts in the time window: Takes the count of the number of alerts in the time window selected to set the priority of the incident created.


Critical, High, Medium, and Low: Specify the incident priority threshold of the matched incidents. The defaults are:

  • Critical: 90
  • High: 50
  • Medium: 20
  • Low: 1

For example, with the Critical priority set to 90, incidents with a risk score of 90 or higher will be assigned a Critical priority for this rule.

Group By Meta Key Mappings

The following table shows the mapped meta keys for the available Group By field selections. For example, if you select the Group By field value Destination Host, it uses the mapped meta key alert.groupby_host_dst. All alerts with the same meta key value for alert.groupby_host_dst are grouped together in the same incident.

Group By Field ValueMapped Meta Key
Alert Rule Idalert.signature_id
Alert Typealert.groupby_type
Date Createdalert.timestamp
Destination Countryalert.groupby_destination_country
Destination Domainalert.groupby_domain_dst
Destination Hostalert.groupby_host_dst
Destination IP Addressalert.groupby_destination_ip
Destination Port alert.groupby_destination_port
Destination User Accountalert.groupby_user_dst
Detector IP Addressalert.groupby_detector_ip
Domain alert.groupby_domain
Domain for Suspected C&Calert.groupby_c2domain
File Analysisalert.groupby_analysis_file
File MD5 Hashalert.groupby_data_hash
Risk Scorealert.risk_score
Service Analysisalert.groupby_analysis_service
Session Analysis alert.groupby_analysis_session
Source Country alert.groupby_source_country
Source Domain alert.groupby_domain_src
Source Host alert.groupby_host_src
Source IP Address alert.groupby_source_ip
Source User Account alert.groupby_user_src
Source Username alert.groupby_source_username
User Account alert.groupby_username
You are here
Table of Contents > NetWitness Respond Configuration Reference > Incident Rule Details View