Custom Rules

All custom rules are listed in a table on the custom rules page. The table lists the Tenant, Group, Alert Severity, Name, Action taken, Status, Tags and Time it was detected.

The table below shows the rules categories in detail:

Options	Description
Tenant	Displays the tenant's details.
Group	Displays the group's details.
Severity	Severity in custom rules are also defined directly by the user who creates the rule. Low: Low severity threats process are killed and files are Quarantined. Medium: Medium severity threats process are not killed and files are Quarantined. High: High severity threats process are killed and files are Not Quarantined. For more information, refer to section Notifications.
Name	Displays the name of the file.
Description	Displays the file description.
Action Taken	When a Custom rule is defined and matched, the following action to be taken. Detect Kill Quarantine Kill & Quarantine Kill & Quarantine & Isolate Network
Status	Displays the enabled or disabled.
Tags	Displays the added tags.
Updated At	Displays the last updated time/date/days /hours.
Created At	Displays the last created time/date/days /hours.

To refine the search for specific issues, click on the Filter icon. It expands and you can select a combination of parameters to filter against.

You also have the options:

1. All Related Scopes: Click drop-down to choose the below options:
   • This Scope and its ancestors
   • This scope and its descendants
2. Table Action: Select the file and click the Table Action to choose the following actions
   • Enable Rule
   • Disable Rule
   • Delete Rule
3. Download: Click Download to get the custom rules detail in CSV file.
4. Clear: Click Clear to refresh data.

• Creating Custom Rules