Configure custom rules

Identify the rule name, description (that appears in the Policy Editor), a severity setting, and rule type.

Select the alert action the rule triggers.

Change the default normalized ID.

Select tags that define the categories to which the rule belongs.

To set rule logic, drag and drop the wanted logical elements and components.

Apply filters to event data, flow data, or both.

To select if a specific number of values must occur in a specific field before the component triggers, click .

Select to have the component trigger only if matches do not occur in the time specified in the Time Window field at the gate level.

Select to customize the grouping of the events in a correlation rule. If you have a rule that groups by a specific field, you can override one of its components to match on a field that you specify on the Configure Group By overrides page. Click Configure to set the override field.

Select to exclude the values you select.

Select the metric reference for this expression.

Type a component description.

If you want this rule to reference a Trellix Application Data Monitor dictionary on Trellix ESM, select it on the drop-down list.

Select the relational operator.

Trellix Application Data Monitor:

Select whether the rule triggers when any of the values match the defined pattern, or only if all values match the pattern.

Filter by selected variables:

View hints for the values that you can enter in the Value field.