Managing user-defined rules

You can configure additional security for the IT infrastructure of the company using TAA, IDS, IOC, and YARA rules.

Users with the role Senior security officer can manage TAA, IDS, IOC, and YARA user rules: upload and delete rule files, view tables of uploaded rules in the User rules section, and manage IDS and TAA rule that are added to exclusions in the Settings section, Exclusions subsection of the program web interface.

Users with the role Security auditor can view but cannot edit the lists of TAA, IDS, IOC and YARA user rules and properties of the selected rules, as well as the IDS and TAA rules that are added to exclusions.

Users with the role Security officer can view but cannot edit the lists of TAA, IOC and YARA user rules and properties of the selected rules, as well as the TAA rules that are added to exclusions.

In this section

Using indicators of compromise (IOC) and attack (IOA) for Threat Hunting

Managing user-defined IOC rules

Managing user-defined TAA (IOA) rules

Managing user-defined IDS rules

Managing YARA rules

Page top