Managing Rules

Selecting Rules from the Automation menu displays the Rules screen, which provides a space to manage rules for Indicators, Detections, and Health, and to create your own Custom Rules.

Rules

Search Filter dropdown menus

The Search Filter Dropdowns allow users to filter searches for specific Rules based on any information unique to the rule, such as the rule status, description, and ID:

  • RULE STATUS - Filter results by All, Enabled and Disabled.
  • INDICATOR METHOD - Filter results by the following Indicator methods:
    • All
    • Behavioral
    • IDS
    • IPS
    • Machine Learning
    • Signature
    • Threat Intelligence
  • DETECTION ID - Filter results by a specific Rule ID.
  • MITRE TECHNIQUES - Filter results by a specific MITRE technique.
  • DATA SOURCES - Filter results by a specific Data Source.
  • DATA SOURCE STATUS - Filter results by All, In Service and Offline.
  • DATA SOURCE CATEGORY - Filter results by the following Data Source categories:
    • All
    • Application Logs
    • Cloud Activity Logs
    • Cloud Security Logs
    • EDR Telemetry Logs
    • Email Security Logs
    • Endpoint Security Logs
    • Host and Entity Information
    • Identity and Access Management Logs
    • Network Security Logs
    • System Logs
    • Threat Intelligence
    • Windows Logs

Column selection dropdown

This allows users to add additional columns of information to the displayed rules, as follows:

  • Indicator Method – Indicates whether the rule is behavioral or signature-based.
  • Data Sources – Lists the Data Sources upon which the rule depends.
  • Mitre Technique – Lists the Mitre threat tactics associated with the rule.
  • Indicators (24h)– Displays a count of Indicators triggered by the rule within the past 24 hours.
  • Detections (24h) – Displays a count of Detections triggered by the rule within the past 24 hours.
  • Mitre Tactic – If applicable, shows the Mitre Tactic associated with the rule.
  • Rule Parameters – Displays the icon to configure the rule parameters, when applicable.
  • Enabled– Displays the checkbox to enable or disable a rule. When an Admin, which is usually a   Data Science or SOC expert, disables a rule for a specific Forescout client account they must specify the reason why. Disabled rules have a symbol next to the "Enabled" indicator. Hovering over the symbol displays the reason why the rule was disabled, with additional comment provided in the rule details if applicable.
  • Globally Disabled– Enables indication of whether the rule has been globally disabled for all   accounts, if applicable.
  • General– Provides a description of the rule and identifies the Data Source(s) that it relies on.
  • Mitre ATT&CK Information – When relevant, this lists the Mitre ATT&CK threat use case associated with the rule, including identification of specific tactics and sub-techniques.
  • Parameters – For some rules, this setting allows users to configure the rule for specific exclusions.

Rule Details

Clicking a rule displays the Rule Details screen. The Rule Details screen consists of the following:

  • General– Provides a description of the rule and identifies the Data Source(s) that it relies on.
  • Mitre ATT&CK Information – When relevant, this lists the Mitre ATT&CK threat use case associated with the rule, including identification of specific tactics and sub-techniques.
  • Parameters – For some rules, this setting allows users to configure the rule for specific exclusions.
  • Rule Code – Presents the rule logic that defines the criteria for triggering an indicator/detection rule. This logic is helpful during an investigation to fully understand what specific behaviors or patterns identify potentially malicious behavior.

Custom Rules

See Custom Rules for a description of Custom Rules and how to create them.