Edit observables rules

Edit observable rules if they need updating or refocusing to match a changed scope.

To edit an existing entity, observable, enrichment, or discovery rule:

1. In the left navigation bar, go to Data configuration > Rules > Observables.

2. In the Rules view, click the Entity, Observable, Enrichment, or Discovery tab, and then click anywhere in the row corresponding to the rule you want to modify.

3. In the rule detail pane, click the menu icon , and from the drop-down menu select Edit.
   The rule editor is displayed, and you can modify the selected rule.

4. Enter your changes as needed.

5. To store your changes, click Save; to discard them, click Cancel.

Alternatively:

1. In the Rules view, browse to the rule you want to edit, and then click the menu icon .

2. From the drop-down menu select Edit.
   The rule editor is displayed, and you can modify the selected rule.

3. Enter your changes as needed.

4. To store your changes, click Save; to discard them, click Cancel.