Manage observable rules#
Manage observable rules from the List of observable rules.
To get to the list of observable rules:
Enable or disable a rule#
A rule must be enabled for it to take effect.
While a rule is enabled, it is only run against new objects on EclecticIQ Intelligence Center that:
match the rule’s criteria, and
are ingested or created on EclecticIQ Intelligence Center while the rule is enabled.
A rule is not run on existing objects on EclecticIQ Intelligence Center unless it is manually run.
Enable#
To enable a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Enable.
Enable when creating rule
Select Enabled when creating a rule. See Create observable rules.
Disable#
To disable a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Disable.
Manually run rules#
When a rule is enabled, it is not automatically run.
To manually run rules:
Enable and run
When you enable a rule, a dialog box pops up asking if you want to run the rule now. Select Run now to run the rule now.
Select a rule to open it.
Select Enable.
In the dialog box that opens, select Run now.
Run now
You can run a rule using the Run now option.
Select a rule to open it.
Select Run now.
Alternatively:
Edit rules#
To edit a rule, do one of the following:
From the list of rules
From an open rule
Do one of the following:
Delete rules#
Caution
Deleting a rule is irreversible. You may want to disable a rule instead.
To delete a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Delete.
Filter rules#
Filter by rule name
To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.
Filter menu
Select Filter to display the filter menu.
Here, you can filter rules by:
Category |
Description |
---|---|
Status |
Filter rules by whether they are Enabled or Disabled. |
Source |
Filter rules by their Source criteria. See Create observable rules. |
Classification |
Filter rules by their Classification action. See Create observable rules. |
View matching observables#
Observables that match a rule criteria are displayed as observable relationships.
If an observable rule returns matches, they are displayed in the Matches tab of the observable rule detail pane.
To view matches for a rule:
Open the rule by selecting it.
Select the Matches tab.
Note
If the Action for an observable rule is Ignore, the Matches tab may still display observables. That’s because the Ignore action only prevents ingestion of observables after the rule is enabled.
For more information on the Ignore action, see Create observable rules.