- Welcome to Threat Detection Management
- Analytics Rules
- Correlation Rules
- Threat Scoring
Update Analytics Rules
Review and accept new analytics rules, analytics rules deletions, and updates to existing analytics rules.
To ensure you have the latest threat detection capabilities, Threat Detection Management regularly updates your analytics rules with the latest threat research, automatically adds new rules in a disabled state, and deletes obsolete rules.
You can accept rule changes to multiple enabled rules or disabled rules in bulk without reviewing the changes first, or for a more cautious approach, accept changes for an individual rule only.
Apply Changes to an Individual Rule
Selectively review and apply changes to individual rules.
To find analytics rules with pending changes, filter analytics rules by Update.
To review what's changed in a rule, click the More menu
, select Details, then click Show changes.
A red background indicates a part of the rule is removed with the update. A dark green background indicates a part of the rule is added with the update.
To apply the change:
In the rule details, click Update.
For the rule, click the More menu
, then select Update.
Apply Changes to Enabled Rules in Bulk
Review and accept pending changes to multiple enabled rules at once.
Under Updates, view the total number of enabled rules with pending changes.
You can't review what's changed in detail. To review changes in detail, you must review the changes for each individual rule.
Click View and update.
Review all rules with pending changes:
Name – The name of the rule with pending changes.
Update – The nature of the change. Update indicates that the change modifies the rule. Obsolete indicates that the change removes the rule.
Change – The nature of the change. Updating indicates that the change modifies the rule. Deleting indicates that the change deletes the rule.
Actions – View rule details or delete the change. To view rule details, click
. To delete the change, click
.
To find specific rules, filter the rules by Update or Change columns.
Select the rules to which you're applying pending changes:
To select all rules, click the checkbox in the header row.
To select specific rules, click the checkbox for each rule.
Determine whether the analytics engine re-trains and reprocesses past events using the rule changes:
To apply rule changes without re-training the analytics engine on past events, select Apply Changes Without Training.
Consider applying changes without training if you want to apply the changes immediately, minimize disruptions to other Exabeam applications, ensure the analytics engine continues to run in real time, and ensure you don't use any of your entitled training days.
Keep in mind that applying changes without training increases the risk of false positives and limits the analytics engine from adapting to evolving patterns in entity behavior.
To re-train the analytics engine on past events with the rule changes, select Apply Changes and Re-train. By default, the analytics engine begins training using the rule changes on the past 21 days of event data.
To change the start date of events the analytics engine uses to re-train:
Click Advanced Settings.
Under Training Start Date, click the date field, select a date using the calendar. You can re-train the analytics engine on up to 30 days of events, with a recommended minimum of 14 days of events.
Click Confirm.
Click Apply Rule Changes. If you selected Apply Changes and Re-train or Trigger on Historical Events, the analytics engine temporarily stops processing incoming events to re-train on past events using the rule changes.
Apply Changes to Disabled Rules in Bulk
Review and accept pending changes to multiple disabled rules at once.
Under Updates, view the total number of disabled rules with pending updates.
You can't review what's changed in detail. To review changes in detail, you must review the changes for each individual rule.
Click Update. All pending changes for disabled rules are automatically applied.