Create an indicator rule by adding individual conditions in the Web UI

This topic shows you how to use the Endpoint Security (HX) Web UI to create a custom indicator rule by adding individual conditions. The instructions below are based on the information in the following example.

Suppose you suspect that a file named cmd.exe is malicious. You can create a custom indicator rule to have your agents monitor the creation or modification of files with that name on their hosts. You know that the file has a filepath of C:\Windows\system32\cmd.exe, an MD5 hash of a9a3daa780ca6c9671a19d52456705b4, and a size of 256 bytes.

Important
Custom indicator rules are not supported for Linux conditions.

To create an indicator rule by adding individual conditions in the Web UI:

Select Rules from the Configure section of the main menu to access the Rules page.
On the Indicators tab, click the + Create indicator button.
On the Create Indicator page, specify an indicator rule name in the Indicator Name box. Indicator rule names can use the following characters:
- Capital and lowercase letters A (a) through Z (z)
- Positive numbers 0 through 9
- Spaces
- Special characters: ()-.,_[]
Select the operating systems (Windows or Mac OS X) associated with the indicator rule in the Operating System list.
Important
Do not automatically accept the default operating system. Be sure to select an operating system before you add any conditions for the indicator.
Under 1. Define indicator, select the appropriate type of condition for the indicator rule (file, network connection, or DNS lookup) in the Look for list under Add Individual Conditions, and then click Add.
For the example above, you would select file. If you want agents to look for evidence of network connections or DNS lookups, you would choose the relevant option in the Look for list.
In the Look for dialog box, choose the type of custom indicator rule and enter appropriate values.
Here is what you would enter for the example above:
- For File Path, choose equal, and then enter C:\Windows\system32\cmd.exe
  Regular expressions you use in your custom indicator rules are validated if the regex is for a file path condition that uses the matches operator. If the regex is invalid, the following message appears at the top of the Endpoint Security (HX) Web UI:
  Warning
  Unable to save the indicator. One or more conditions contains and invalid regex.
- For MD5, choose equal, and then enter a9a3daa780ca6c9671a19d52456705b4
- For File Size choose equal, and then enter 256
  Important
  If you mistakenly enter only part of an MD5 hash or IP address, the entry may appear as a hostname in a condition. To avoid conflicts with existing hostnames, Trellix recommends that you delete such conditions.
  Custom indicator condition values can be set to a maximum of 255 ASCII and escaped Unicode characters. The Endpoint Security truncates uploaded indicator conditions that are longer than 255 characters. False positives can result if a condition is truncated.
Click Add.
In the pane on the right side of the Create Indicator page, you can preview the condition you just added.
To add another condition, repeat the previous steps.
To delete a condition, hover over it, and then click the x icon in the upper right corner.
(Optional) Under 2. Describe indicator, you can enter a description of the indicator.
Click the Create button.
Your indicator rule appears on the Indicators page.