Create a custom rule in new rule page

On the Rules page, select the Custom Rules tab, then click Create New Rule.

In the Name field, enter a name for the rule. It is recommended that the name selected clearly reflect the nature of the rule, for example, Sensitive HR tables or PCI-DSS password protection.

In the If fields, define the first rule comparator statement as follows:

1. In the first field, type the first letter of the identifier name, then select the required identifier from the drop-down list.

2. In the second field, select the required operator from the drop-down list.

3. In the third field, enter the literal component to be matched. If the literal component is a string, the text must be enclosed in single quotation marks.

   Note

   Alternatively, you can enter the comparator statement directly into the text box under the If fields, entering a space to access the respective drop-down lists.

Click Add.

If the rule includes more than one comparator statement, enter the relevant Boolean operator (AND, OR, or NOT) in the fourth field, then define the next comparator statement. Repeat for additional comparator statements as required.

Note

If there is a problem with the rule syntax, validation fails and a message is displayed. For example, if you fail to enclose a text string in single quotation marks, a message is displayed regarding an unexpected token.

(Optional) To turn off the auto-completion feature, select Disable auto completer.

Note

You can define rule objects, which can then be used as components in other rules. For example, a rule object might be used in the definition of a rule intended to allow a specific range of IP addresses.

To create an exception to this rule, click Add Exception. Then, in the Exception(s) text box, enter a comparator statement that defines the conditions which when matched are treated as an exception to this rule. Repeat to define additional exceptions as required.

In the Then area, select the required actions that the rule should trigger.

Caution

The Terminate option should be used sparingly because terminating sessions can disrupt legitimate business transactions. Use the terminate option only in the following conditions:

• You are certain that the rule will not create false positives (we recommended to use the rule first in alert only mode to make sure that legitimate traffic is not affected).

• The risk involved with the rule condition is high.

• Terminating a session causes only minimal disruption to other transactions.

Note

Quarantine is done based on the quarantine settings in the System tab. Make sure that you edit the quarantine settings before you enable quarantine on any of your rules.

To allow the statement to be processed if the rule is matched, select Allow. This enables you to create an exception to a rule that appears later in the policy.

To stop the matching process if a rule is matched, select Stop Verifying Additional Rules. This is the default setting when the rule is set to Allow. If this option is not selected, the matching process continues.

To select the DBMSs where the rule is applied:

1. In the Install On, click DBMSs & Groups.

2. In the Install on DBMSs and DBMS Groups , select one or more relevant DBMSs or DBMS groups, then click Save to return to the rule definition.

The selected DBMSs and DBMS groups are listed in the DBMSs & Groups fields respectively.

To assign a tag to the rule, enter the tag name in the Tags field or enter a space in the field to select the tag from the drop-down list.

(Optional) By default, all users can edit the properties of a custom rule. To limit the ability to edit the properties of this rule to specific users or users assigned a specific role, enter the user names or role names in the Grant edit permission to role/s field.

In the Comments field, enter a free text description or comment.

To enable the rule, select Enable Rule.

Note

You can enable or disable the rule at any time by selecting or deselecting the Enable Rule checkbox.

To prevent the triggering of alerts by signed scripts, select the Ignore Signed Scripts checkbox.

Click Save to save the rule.