Configure Basic Threat Triage Rules

You can use the Threat Triage field in the Management UI to assign basic threat triage rules and scores. To specify more granular triage rules, you need to specify the information with the CLI or the Advanced JSON field in the Management UI.

1. On the sensor panel, in the Threat Triage field, click .

   
   
   

2. To add a rule, click +.
   
   
   
3. Assign a name to the new rule in the NAME field.
4. In the RULE field, enter the syntax for the new rule. For example:

   Exists(IsAlert)

5. In the SCORE ADJUSTMENT field, enter a threat score for the rule. For example:

   10

6. You can click TEST to validate your rule and score adjustment.
7. Click SAVE.
   The new rule is listed in the Threat Triage Rules panel.
8. Choose how you want to aggregate your rules by choosing a value from the Aggregator menu.
   You can choose among the following:

   MAX

   The maximum of all of the associated values for matching queries.

   MIN

   The minimum of all of the associated values for matching queries.

   MEAN

   The mean of all of the associated values for matching queries.

   POSITIVE_MEAN

   The mean of the positive associated values for the matching queries.

9. Click SAVE.