Skip to main content
Version: 6.2

Cyber Security: Rule Enablement Order

Contents​

Overview​

All module rules are supplied disabled and must be enabled in stages. First, enable service rules that populate behavioral baseline lookups. Then enable rules for connected sources, followed by threshold rules after adjusting their thresholds, and behavioral baseline rules after enough data has accumulated.

Staged enablement lets you assess the incident volume for each source and tune the rules before enabling the entire set.

Prerequisites​

Before enabling rules for a source, verify three conditions.

  1. The source is configured as described in Configuring Infrastructure Sources
  2. Data arrives in the source indexes in the required format; see Connecting and Configuring Data Collection
  3. Infrastructure, account, and exclusion lookups used by the source rules are populated; see Lookups
Important

A rule enabled without source data does not create incidents but still consumes execution resources. A rule enabled without populated exclusion lookups produces a stream of false positives.

Enablement Stages​

Stage 1. Service Rules​

Service rules do not create incidents. They populate behavioral baseline lookups on a schedule and carry the Служебное tag.

  • enable all service rules as soon as data starts arriving
  • run them manually the first time if necessary, without waiting for the schedule
  • verify that the automatically populated baseline lookups contain data

Stage 2. Source Rules​

  • enable rules for one source at a time, in this order: Windows, Active Directory, Linux, Web (IIS and nginx), Kubernetes
  • monitor incident volume for 5 to 7 days after enabling the rules
  • tune rules with recurring false positives as described in Tuning for Your Infrastructure
  • within each source, enable rules from low to high severity. Low-severity rules usually have broader conditions, making it easier to assess false positive volume

Stage 3. Threshold Rules​

Rules with numeric thresholds (password brute-force attempts, scanning, and bulk operations) are designed for a typical activity profile. Before enabling them, evaluate their thresholds against your infrastructure data as described in Threshold Rules.

Stage 4. Behavioral Baseline Rules​

These rules compare host or user activity with an accumulated behavioral baseline. Service rules build the baseline as data arrives, so baseline rules are not ready immediately after data collection starts.

  • enable the rules after the service rules have built the baselines
  • hosts and users with insufficient history are not evaluated by the rules, so normal activity on newly connected hosts and by new users does not trigger incidents
  • enabling the rules too early can cause a host or user without a baseline to trigger on its own normal activity

Enabling Rules in the Interface​

  1. Go to Main Menu - Job Scheduler - Jobs List
  2. Filter jobs by the Cyber Security tag and the source tag
  3. Select the rules you want to enable and choose Edit Selected - Enable

For more information about scheduler jobs, see Creating and Configuring Jobs.

Schedule and Load​

  • most rules run every 10 minutes and analyze a 15-minute window. The windows overlap so events at run boundaries are not missed
  • rule runs are distributed across the minutes of each 10-minute interval. Do not move many rules to the same minute because this increases cluster load
  • repeat incidents for the same object are suppressed by its key fields

Verification After Enablement​

  • incidents are created in Incident Manager for test events
  • the incident volume for each rule matches expectations. Tune rules with anomalous volume as described in Tuning for Your Infrastructure
Documents Included with the Module

The "Rule Enablement and Tuning Order" document included with the module lists service rule schedules, baseline accumulation periods, threshold rules, and special enablement cases.