Filtering and searching TAA (IOA) rules

To filter or search for TAA (IOA) files based on required criteria:

In the window of the program web interface, select the User rules section, TAA subsection.
This opens the TAA (IOA) rule table.
Depending on the filtering criterion, do the following:
- By importance
  1. Click the icon to open the IOA rule filter configuration window.
  2. Select the check boxes next to the importance levels that you want to include in the filter criteria:
    - Low.
    - Medium.
    - High.
  3. Click Apply.
- By rule type
  1. Click the Type link to open the filter configuration window.
  2. Select one of the following options:
    - All – all rules.
    - Global – rules created on the PCN server. These rules are used to scan events on this PCN server and all SCN servers connected to this PCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).
      Operation mode in which the program can be used to protect the infrastructure of several organizations simultaneously.
      
      Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a master control server (Primary Central Node (PCN)) and slave servers (Secondary Central Nodes (SCN)).
    - Local – rules create on an SCN server. These rules are used to scan events on this SCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).
- By confidence level
  1. Click the Confidence link to open the filter configuration window.
  2. Select the check boxes opposite those confidence levels that you want to add to filter criteria.
    - Low.
    - Medium.
    - High.
  3. Click Apply.
- By rule name
  1. Click the IOA tag link to open the filter configuration window.
  2. Enter one or several characters of the IOA rule name.
  3. Click Apply.
- By server name
  1. Click the Servers link to open the filter configuration window.
  2. Select the check boxes next to the organizations or servers within the organizations that you want to include in the filter criteria.
  3. Click Apply.
- By rule-based alert generation
  1. Click the Generate alerts link to expand the filter settings list.
  2. Select one of the following options:
    - All
    - Enabled
    - Disabled
- By rule state
  1. Click State to expand the filter settings list.
  2. Select one of the following options:
    - All
    - Enabled
    - Disabled

The table displays only rules that match the specified criteria.

You can use multiple filters at the same time.