Adding Sigma rules to a custom collection

To add Sigma rules to a custom collection:

  1. In the main window of the Web Console, select Assets (Devices) → Policies & profiles.
  2. Click the name of the Kaspersky Industrial CyberSecurity for Nodes policy.

    The policy properties window opens.

  3. Select the Application settings tab.
  4. In the Anomaly Detection using Sigma rules section, use the check box next to the collection name to select a custom collection of Sigma rules that you want to add one or more Sigma rules to.
  5. Click Edit.

    The Changing the Sigma rules collection window opens.

  6. Add Sigma rules in any of the following ways:
    • Manually:
      1. Click Add.

        The Changing the Sigma rule window opens.

      2. In the editor form, describe the rule in Sigma format.
      3. Click OK.

        The described Sigma rule will be displayed in the list of rules in the collection. The rule is enabled by default (the toggle button to the left of the rule name is in the Enabled position).

      4. Repeat steps a-c for each rule being manually added.
    • From files:
      1. Click Add file.
      2. In the window that opens, select one or more YAML files that describe Sigma rules.
      3. Click Open.

        Sigma rules described in YAML files will be displayed in the list of rules in the collection. Rules are enabled by default (the toggle switches to the left of the rule names are in the Enabled position).

        If a Sigma rule contains syntax errors or if mandatory attributes are missing, the rule will not be added to the collection.

  7. Click OK.
Page top