Manage observable rules#

Manage observable rules from the List of observable rules.

To get to the list of observable rules:

From the left navigation, select Data configuration > Rules > Observables.

Go to Data configuration > Rules > Observables.#

Enable or disable a rule#

A rule must be enabled for it to take effect.

While a rule is enabled, it is only run against new objects on EclecticIQ Intelligence Center that:

match the rule’s criteria, and
are ingested or created on EclecticIQ Intelligence Center while the rule is enabled.

A rule is not run on existing objects on EclecticIQ Intelligence Center unless it is manually run.

Enable#

To enable a rule, do one of the following:

From the list of rules

Locate the rule you want to enable.
Select More on the right of that rule.
Select Enable.

Enable a rule.#

From an open rule

Select a rule to open it, then select Enable.

Enable when creating rule

Select Enabled when creating a rule. See Create observable rules.

Disable#

To disable a rule, do one of the following:

From the list of rules

Locate the rule you want to disable.
Select More on the right of that rule.
Select Disable.

From an open rule

Select a rule to open it, then select Disable.

Manually run rules#

When a rule is enabled, it is not automatically run.

To manually run rules:

Enable and run

When you enable a rule, a dialog box pops up asking if you want to run the rule now. Select Run now to run the rule now.

Select a rule to open it.
Select Enable.
In the dialog box that opens, select Run now.

Enable and run a rule.#

Run now

You can run a rule using the Run now option.

Select a rule to open it.
Select Run now.

Alternatively:

Select a rule to open it.
Select More > Run now.

Edit rules#

To edit a rule, do one of the following:

From the list of rules

Locate the rule you want to edit.
Select More on the right of that rule.
Select Edit.

From an open rule

Do one of the following:

Select Edit from the top right.
Select More > Edit from the top right.

Delete rules#

Caution

Deleting a rule is irreversible. You may want to disable a rule instead.

To delete a rule, do one of the following:

From the list of rules

Locate the rule you want to delete.
Select More on the right of that rule.
Select Delete.

From an open rule

Select a rule to open it, then select Delete.

Filter rules#

Filter by rule name

To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.

Enter an exact term to filter rule names.#

Filter menu

Select Filter to display the filter menu.

Here, you can filter rules by:

Category	Description
Status	Filter rules by whether they are Enabled or Disabled.
Source	Filter rules by their Source criteria. See Create observable rules.
Classification	Filter rules by their Classification action. See Create observable rules.

View matching observables#

Observables that match a rule criteria are displayed as observable relationships.

If an observable rule returns matches, they are displayed in the Matches tab of the observable rule detail pane.

To view matches for a rule:

Open the rule by selecting it.
Select the Matches tab.

Matches tab displays observables that this rule currently matches.#

Note

If the Action for an observable rule is Ignore, the Matches tab may still display observables. That’s because the Ignore action only prevents ingestion of observables after the rule is enabled.

For more information on the Ignore action, see Create observable rules.