Configuring Custom Attack Surface Insight Rules
If it becomes necessary to configure one of the required Attack Surface Insights rules with a different criticality level than the pre-built rules offer, you can configure a custom rule.
On the New-Scale Security Operations Platform home page, navigate to Security Management column and click the Attack Surface Insights tile.
At the top of the page, select the tab for the type of entities you want to search for in your environment: Users or Devices.
In the search bar at the top, use one of the following techniques to define a query that will identify the entities you want to associate with a pre-built rule.
Basic – This search method is a point and click option that allows you to build a query without knowing the specific Exabeam Query Language. For information, see Build a Search in Attack Surface Insights.
Advanced – This search method lets you enter a query manually using Exabeam Query Language. For more information, see Enter a Search in Attack Surface Insights.
Run the query and examine the entities returned in the search results. Adjust and rerun the query until you are satisfied with the results.
Under the search bar, select the Advanced option for Search mode and copy the final query from the search bar. Then click Set Rules in the top right corner. The Rules panel opens and displays the existing rules.
In the Rules panel, click + New Rule. The Create Rule dialog box opens.
In the dialog box, do the following:
Enter a Rule name.
Enter a Description.
In the Condition field, paste the final query that you copied to your clipboard.
In the Actions section, click in the Tags field and select the appropriate tag. Depending on which of the required rules you are creating, select one of the following tags:
Privileged User,Service Account,Executive,Critical Device. For a chart of these required rules, see Step 7 - Configure Attack Surface Insights Rules (Best Practice).Click in the Security Criticality field and select the desired criticality level.
Click the Enabled check box to enable the rule.
Click Save to apply the modified rule logic.
