Skip to main content

Threat CenterThreat Center Guide

Edit a Detection Grouping Rule

Change the conditions and actions for a detection grouping rule.

You can't edit pre-built detection grouping rules. To change a pre-built detection grouping rule, clone the rule, then edit the rule. You can also disable a pre-built detection grouping rule.

You can't rename a detection grouping rule.

  1. In Threat Center, click Settings, then navigate to the Detection grouping rules tab.

    Link to Threat Center settings highlighted in a red rectangle.

  2. For a rule, click the More menu Three blue vertical dots, then select Edit.

  3. Change the conditions and actions of the rule.

  4. Click Save.