Creating Custom Rules

The user who creates the custom rules can define the severity of a custom rule, but it may detect a process launch without killing/quarantining it.

To create Custom Rules

1. Navigate to Policy > Custom Rules and click +Create.
2. Type the Name and Description.
3. Select the Severity from the drop-down.
4. Type the Tags.

5. Select the Kill, or Quarantine, or Isolate Network on your requirement.

   By default, Detect will be enabled.

To set up the Process Conditions and Event Conditions

The custom detection policies are created on the conditions that were specified by users like process, file and registry activity conditions.

1. Under the Process Conditions section, select AND or OR button to add the process and group.

   1. Select the drop-down matches or not matches and enter the Process Path.
   2. (Optional) Select the drop-down matches or not matches and enter the Command Line.
   3. Select the drop-down Signed or Not signed.

   A process must have only one parent process. Also configuring two parents process conditions for a single process is not recommended .

   

2. Under the Parent Process Conditions section, select AND or OR button to add the parent process.

   1. Select the drop-down matches or not matches and enter the Parent Process Path.
   2. (Optional) Select the drop-down matches or not matches and enter the Command Line.
   3. Select the drop-down Signed or Not signed.

   A process must have only one parent process. Also configuring two parents process conditions for a single process is not recommended .

   

3. Under the Event Conditions section, select AND or OR button to add the rule and group.

   

1. Child Process
1. Select the drop-down matches or not matches and enter the Child Process Path.
2. (Optional) Select the drop-down matches or not matches and enter the Command Line.

3. Select the drop-down Signed or Not signed.

2. Registry
1. Select the drop-down to create or delete the Event.
2. (Optional) Select the drop-down matches or not matches or equals any or equals none and enter the Key, Name, and Value.
3. File
1. Select the drop-down to create or delete or write/modify or rename the Event.
2. (Optional) Select the drop-down matches or not matches and enter the file Path.

4. Click Save.