Custom Rules

Custom Rules can be created and viewed by selecting Custom Rules from the Automation menu.

The Data Science team continuously develops, tests, tunes and deploys new and existing threat Indicator, threat Detection and Health monitoring rules to the platform that are typically available to all users.

eyeAlert's Custom Rules provides individual users with the ability to create their own Indicator, Detection and Health rules that operate uniquely within their environment.

Custom Rules are a powerful tool for quickly fine-tuning the platform automaton for a tailored cybersecurity threat monitoring and response strategy. The feature enables users to quickly create correlation rules with a guided user experience.

This helps to decrease response times for monitoring known attacks and can also serve as an accelerator for expanding threat detection coverage. Custom Rules can also be used by SOC Analysts to immediately monitor a proven threat-hunting hypothesis and by SOC Engineers to write Health monitoring rules.

The following are examples of use cases that can be monitored using the Custom Rules feature:

• Detection of Unprivileged Authorization Granted
• Simple Log Field Presence Indicator
• Credential Dumping Detection

For information about how to create a Custom Rule, click here.

For information about Custom Rules, click here.