Rule tuning allows you to modify or adjust Trellix rules.
Tip
For help with understanding TQL and its syntax, see the TQL Reference Guide.
To tune a Trellix rule:
In the Trellix Rules tab of the Rules page, click on the name of a Trellix rule.
Click the Tune Query button.
Enter a TQL query in the Tuned Query Field, such as "
NOT srcipv4=1.2.3.4"Adjust the threshold and interval as needed.
Click Save. The new values will be appended to the original query.
Note
The modified query parameters override the original query parameters.
To edit a tuned Trellix query:
In the Trellix Rules tab of the Rules page, click on the name of a tuned Trellix rule.
Click the Edit Tuned Query button.
Modify the TQL query, threshold, and interval as needed.
Click Save.