Helix Enterprise may disable a rule that you have created to ensure performance and stability. There are three circumstances that can result in your rule being throttled:
Your rule matches on too many events per second. If you receive this error, you can:
Refine the rule’s query so that fewer events are likely to match.
Your rule generated too many unique distinguishers. If you receive this error, you can:
Refine the rule’s query so that fewer events are likely to match
Consider removing one distinguisher field if your rule uses more than one.
If the Window is greater than one minute, remove the Window altogether.
If the Threshold is greater than one, remove the Threshold.
Your rule generated too many alerts within a window of time. This error is most often seen when a rule creates 10 or more alerts in less than one second. If you receive this error, you can:
Refine the rule's query so that fewer events are likely to match.
Consider removing one distinguisher field if your rule uses more than one.
Note
If a rule is disabled, the reason is listed below the Revision History table at the bottom of the rule page. If a rule has been previously disabled and you attempt to change or tune the rule but it is still disabled, the new reason will not be listed unless the original reason is cleared. However, the new reason is visible if you use the Developer Tool.
Best practices for creating rules
Avoid writing queries that are too broad. The more focused your query, the fewer matches per second it will generate. If you are trying to detect behavior that requires a broad query, then try to limit the number of distinguishers that this rule uses.
Avoid choosing distinguishers that can result in a random distribution of their values. If there are large numbers of unique combinations (500,000+), performance can be greatly impacted.
Limit the number of distinguishers for each individual rule. This is critical when writing rules that generate assertions, but do not generate alerts. Note that if a rule is generating only assertions, then you most likely do not need to use distinguishers at all.
Limit the window on rules that do generate alerts to 1 minute for as many alerting rules as possible.
Limit the Threshold value. Unless it is critical for the rule to function, it is best to leave the Threshold as low as possible to minimize the number of overall matches. For example, the following rule uses a broad query, multiple distinguishers, a large window, and a large Threshold:
Search: metaclass:[http_proxy,firewall,connection] Distinguishers: srcipv4, dstipv4, srcport, dstport Window: 1 day Threshold: 10
This rule can be dramatically improved by narrowing its scope:
Search: metaclass:[http_proxy,firewall,connection] srcipv4:153.251.53.0/24 srcport:80 Distinguishers: srcipv4 Window: 1 minute Threshold: 1
Tip
Do not use regular expressions to search raw fields like
rawmsg. Use a parsed field that contains the value you are looking for. For example, if the event has themsgparsed field and contains the string values you're looking for, use the following regular expression query:msg:"/.(ModuleVersion)./"