Parsing rules and policies overview

A Receiver uses parsing rules to match logs sent to it by data sources. A parsing rule is a logic string that identifies events. When a log matches a rule, the parser creates an event or a data source rule.

You can use parsing rule ordering to reduce processing time in large rule sets. Rules run in the order that you designate (Policy Editor > Operations > Order ASP Rules or Order Filter Rules). Run the most specific rules (rules that return the fewest results) first. Run catch-all rules last.

Rules can be enabled and disabled. Use care when disabling a rule because the parser does not create events for logs that match the disabled rule. This can have unintended consequences.

A policy is a wrapper for a group of parsing rules that has its own properties (inheritance and sharing, for example). Policies make it easier to work with parsing rules and the global variables that rules can use. You can use policies to apply rules to data sources more efficiently than working with each rule and data source individually. Policies are applied to receivers or to data sources. Devices that have the same set of rules share the same policy if they 1) inherit the same values from their parent policies, and 2) are on the same receiver.

The Default Policy is the parent of all other policies. Settings for other policies and devices inherit their values from the Default Policy. The Trellix rule server maintains rules, variables, and pre-processors with predefined values or usages. The Default Policy gets its values and settings from the Trellix rule server.

Policies can be set up in hierarchies, with subordinate policies inheriting the settings of the parent policies. You can enable and disable inheritance using the Policy Editor.

The Policy Editor tool lets you manage policies across all the assets on your network. You can open it from the main navigation menu.