How to create Custom Rules

Clicking the +Create Custom Rule button displays the Create a Custom Rule configuration screen.

The Configuration screens guide you through the completion of four required steps to create a custom correlation rule, which are best completed from top to bottom.

For detailed guidance on configuring each step, see the following:

  • Step 1 - Configure General Settings
  • Step 2 - Configure Search Query
  • Step 3 - Configure Trigger Conditions
  • Step 4 - Configure Outcomes
You can also review examples of configured customer rules here.

The dots turn solid to indicate progress as you move through the step sequence. When all four steps have been configured, the Create Rule button is enabled.

Once created, only a Forescout Cloud Platform Admin user can enable custom rules that trigger a Detection. Those with Forescout Cloud Operator accounts can only enable custom rules that trigger an Indicator.

Step 1 - General Settings

 

The General Settings step defines the type of Custom Rule and its basic execution parameters.

TITLE – Specifies the name of the Custom Rule.

DESCRIPTION – Enter a description to explain the purpose of the Custom Rule.

TYPE – Specifies whether the Custom Rule is for Threat detection or detecting Health incidents.

SCHEDULE – This section specifies the specific time and frequency with which search queries defined by the Custom Rule are carried out. Once scheduled, rules are carried out in the user's local time zone. Rules can be scheduled to execute Hourly, Daily or Weekly.

Time to Live CRITERIA – This section specifies whether the Custom Rule will expire according to specific conditions.

  • Must Trigger - The rule must trigger once within the specified number of days, with the valid range being 1 to 60. If the rule does not trigger within the specified timeframe, it is disabled.
  • Disable After - The rule will be disabled after the specified number days, with the valid range being 1 to 365.
  • Never Expire - The system will never disable the rule, but it can still be disabled manually.

Step 2 - Search Query

The Search Query step is where users specify a search query string for finding logs and log fields that match their search criteria.

Every Custom Rule includes one or more search queries that search logs indexed in Log Storage based on the temporal settings you have specified for a match on the conditions you specify here.

To add more than one Search Query, click the +Query button. You can a specify a maximum of five queries for each custom rule.

QUERY Editor

The Search Query Editor is a typeahead interface that presents all possible options from Forescout's current implementation of the Common Information Model (CIM) that can be used to construct a query. It uses the Lucene Query Syntax, with valid query options presented as you construct the query in the editor.

Every Search Query must begin with identification of a Data Source (data_source:), and you can can only use one Data Source per query. After selecting a Data Source from the available options you can specify either an AND or OR followed by a field/value combination from the available options that appear, which are specific to the Data Source and drawn from the current definition of the CIM.

When crafting a Search Query, be as specific and granular as possible to avoid causing excess Indicators and Detections (e.g., specifying nothing in the Search Query but the Data Source could trigger the rule for every single log event that the Data Source produces).

The following example searches eyeAlert log storage for any one of three Fortinet event log fields:

data_source:fortinet_logs AND event_id:(43009 OR 320003 OR 00014)

Leading wildcards are forbidden (e.g., message:*threat).

GROUP BY - Specifies by what Data Source CIM field the Indicator or Detection will be grouped by when triggered.

Step 3 - Trigger Conditions

The Trigger Conditions step specifies under what circumstances a query or set of queries evaluating to "true" triggers an outcome.

CONDITION Editor

Like the Query Editor, the Condition Editor uses the Lucene Query Syntax and is designed for maximum flexibility in determining the conditions under which an Indicator notification is sent or a suspicious entity is generated based on a Detection. For example, you can define three separate queries and have the trigger condition for an outcome execute when only two of the queries evaluate true X number of times. The default setting is for all defined search queries to evaluate to true.

For Trigger Conditions, eyeAlert supports the Lucene Query Syntax for both complex and simple expressions. The editor supports the "AND", "OR", "NOT" and "()" operators and up to two wildcards can be specified as well.

Step 4 - Outcomes

The Outcomes step specifies what the desired outcome is when a Custom Rule executes and finds search results that match the search query and trigger outcome criteria.

TRIGGER

The TRIGGER selector specifies whether the outcome of a triggered rule is to produce a Detection or an Indicator.

  • Detection – When Detection is selected, you must specify the SEVERITY of the Detection, what the Detection will be ATTRIBUTED TO and you can optionally give it a separate DETECTION NAME. A Detection based on a Custom Rule produces a Suspicious Entity or Health Entity on the Threats Screen, where Custom Rule detections are labeled as CR"X".
  • Indicator – When Indicator is selected, you must specify what the Indicator will be ATTRIBUTED TO and who will be notified by email that the Indicator has triggered. The email notification details the account, entity, indicator type, the first time it was triggered, and the total number of times it has been triggered:

Each Indicator email notification ends with a link to more information. Clicking this link will take you to the Indicator index under the Forescout Cloud Logs tab to display the Indicator details.