Filtering and searching IOA rules

To filter or search for IOA rules based on required criteria:

1. In the program web interface window, select the IOC/IOA Analysis section, IOA Analysis subsection.

   The table of IOA rules opens.

2. Depending on the filtering criterion, do the following:
   • By importance
     1. Click the icon to open the IOA rule filter configuration window.
     2. Select the check boxes next to the importance levels that you want to include in the filter criteria:
        • Low.
        • Medium.
        • High.
     3. Click the Apply button.
   • By rule type
     1. Click the Type link to open the filter configuration window.
     2. Select one of the following options:
        • All – all rules.
        • Global – rules created on the PCN server. These IOA rules are used to scan events on this PCN server and all SCN servers connected to this PCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).

          Operation mode in which the program can be used to protect the infrastructure of several organizations simultaneously.

          Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a master control server (Primary Central Node (PCN)) and slave servers (Secondary Central Nodes (SCN)).

        • Local – rules create on an SCN server. These IOA rules are used to scan events on this SCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).
   • By confidence level
     1. Click the Confidence link to open the filter configuration window.
     2. Select the check boxes opposite those confidence levels that you want to add to filter criteria.
        • Low.
        • Medium.
        • High.
     3. Click the Apply button.
   • By rule name
     1. Click the Name link to open the filter configuration window.
     2. Enter one or several characters of the IOA rule name.
     3. Click the Apply button.
   • By server name
     1. Click the Servers link to open the filter configuration window.
     2. Select the check boxes next to the organizations or servers within the organizations that you want to include in the filter criteria.
     3. Click the Apply button.
   • By rule-based alert generation
     1. Click the Generate alerts link to expand the filter settings list.
     2. Select one of the following options:
        • All
        • Enabled
        • Disabled
   • By rule state
     1. Click State to expand the filter settings list.
     2. Select one of the following options:
        • All
        • Enabled
        • Disabled

The table of IOA rules displays only IOA rules that match the filter criteria you have set.

You can use multiple filters at the same time.

See also Viewing the IOA rule table Viewing information about an IOA rule Enabling or disabling an IOA rule Adding an IOA rule Editing an IOA rule Deleting an IOA rule Viewing an IOA white list Viewing information about an IOA rule in the white list Adding an IOA rule to the white list Removing an IOA rule from the white list Viewing the IOA analysis results Clearing an IOA rules filter

Page top