Threat Detection ManagementThreat Detection Management Guide

For the analytics rule you're disabling, click the More menu or right-click the analytics rule, then select Disable. The change is added to a batch of pending updates. You must now apply the change to your environment for the change to take effect.

Under Engine Status, click View Changes.

Review all rules with pending changes:

To find specific rules, filter the rules by Update or Change columns.

Ensure you select the checkbox for the analytics rule you disabled. You can also select other analytics rule changes you want to apply to your environment.

Determine whether the analytics engine re-trains on past events using the rule changes:

• To apply rule changes without re-training the analytics engine on past events, select Apply Changes Without Training.

  Consider applying changes without training if you want to apply the changes immediately, minimize disruptions to other Exabeam applications, ensure the analytics engine continues to run in real time, and ensure you don't use any of your entitled training days.

  Keep in mind that applying changes without training increases the risk of false positives and limits the analytics engine from adapting to evolving patterns in entity behavior.

• To re-train the analytics engine on past events with the rule changes, select Apply Changes and Re-train. By default, the analytics engine begins training using the rule changes on the past 21 days of event data. After the analytics engine finishes training, analytics rules continue to trigger on incoming events in real-time.

  To change the start date of events the analytics engine uses to re-train:

  1. Click Advanced Settings.

  2. Under Training Start Date, click the date field, then select a date using the calendar. You can re-train the analytics engine on up to 30 days of events, with a recommended minimum of 14 days of events.

  3. Click Confirm.

Click Apply Rule Changes. If you selected Apply Changes and Re-train or Trigger on Historical Events, the analytics engine temporarily stops processing incoming events to re-train on past events using the rule changes.

Select the analytics rules you're disabling:

• To select all analytics rules, click the checkbox in the header row.

  

• To select specific analytics rules, click the checkbox for each analytics rule.

  

Click Disable:

The change is added to a batch of pending updates. You must now apply the change to your environment for the change to take effect.

Under Engine Status, click View Changes.

Review all rules with pending changes:

To find specific rules, filter the rules by Update or Change columns.

Ensure you select the checkbox for the analytics rules you disabled. You can also select other analytics rule changes you want to apply to your environment.

Determine whether the analytics engine re-trains on past events using the rule changes:

• To apply rule changes without re-training the analytics engine on past events, select Apply Changes Without Training.

  Consider applying changes without training if you want to apply the changes immediately, minimize disruptions to other Exabeam applications, ensure the analytics engine continues to run in real time, and ensure you don't use any of your entitled training days.

  Keep in mind that applying changes without training increases the risk of false positives and limits the analytics engine from adapting to evolving patterns in entity behavior.

• To re-train the analytics engine on past events with the rule changes, select Apply Changes and Re-train. By default, the analytics engine begins training using the rule changes on the past 21 days of event data. After the analytics engine finishes training, analytics rules continue to trigger on incoming events in real-time.

  To change the start date of events the analytics engine uses to re-train:

  1. Click Advanced Settings.

  2. Under Training Start Date, click the date field, then select a date using the calendar. You can re-train the analytics engine on up to 30 days of events, with a recommended minimum of 14 days of events.

  3. Click Confirm.

• To re-train the analytics engine and ensure analytics rules trigger on past events, select Trigger on Historical Events, then:

  1. Under Triggering Start Date, specify the the start date of events the analytics engine uses to trigger analytics rules. Click the date field, select a date using the calendar.

  2. Under Advanced Settings, change the start date of events the analytics engine uses to re-train. Under Training Start Date, click the date field, then select a date using the calendar. You can re-train the analytics engine on up to 30 days of events, with a recommended minimum of 14 days of events. Click Confirm.

  3. Having analytics rules trigger on past events may make some Threat Center detections and their associated cases or alerts obsolete. To allow obsolete cases or alerts to be automatically deleted, select Allow changes to closed cases.

  4. You must select the disclaimer, By enabling this option, you acknowledge that reprocessing may disrupt connections with other system components (e.g., alerts, cases, timelines). Some features may be temporarily unavailable during reprocessing.

Click Apply Rule Changes. If you selected Apply Changes and Re-train or Trigger on Historical Events, the analytics engine temporarily stops processing incoming events to re-train on past events using the rule changes.