Skip to main content
Version: 6.2

Rule Families

A rule family classifies an alert, for example process execution, remote access (VPN), or printing. A family does not assign a separate score. It shows which behaviors contributed to an object's score and is used in anomaly detection rules.

To open the lookup page, select Main Menu - Settings - Module Settings - UBA - Rule Families.

Rule family reference

Where Families Are Used​

Families are used in:

  • reactions and the UBA Alert action - a family is selected when classifying an alert and is stored in that alert
  • object cards - the contribution bar and family filter
  • the Why This Score page - contribution breakdown by family
  • anomaly detection rules - the family set and family sequence rule types
  • the anomaly feed - families of triggered rules and the family filter

Family Types​

  • system families - supplied with the module, including process execution, privileged activity, removable media and devices, and others. System families cannot be deleted or renamed
  • custom families - created by users and can be renamed or deleted

Creating a Family​

To create a family:

  1. Go to Main Menu - Settings - Module Settings - UBA - Rule Families
  2. Click Create Family
  3. Fill in Name. The name is required and must be unique
  4. Optionally fill in Description
  5. Click Save
note

Renaming or deleting a family does not change existing alerts: a copy of the family name is stored in each alert. A score breakdown that includes alerts from before the rename shows both names.