- : These are predefined rules, which are developed by LevelBlue. See Correlation Rules for more information.
- Orchestration rules: You can create and customize these rules to add specific policies for a particular or . See Orchestration Rules for more information. These are the orchestration rules:
- Suppression rules: Use these rules to suppress events or alarms that create noise in your system. See Suppression Rules from the Orchestration Rules Page for more information.
- Filtering rules: Use these rules to make the drop future events that match the rule. See Filtering Rules from the Orchestration Rules Page for more information.
- Alarm rules: Use these rules to identify existing and emerging threats. See Alarm Rules from the Orchestration Rules Page for more information.
- Notification rules: Use these rules to create your own rules and receive . See Notification Rules from the Orchestration Rules Page for more information.
- Response action rules: Use these rules to respond to an event or an alarm running an BlueApp. See Response Action Rules from the Orchestration Rules Page for more information.
Rules Management
Rules Management
Every networked environment generates thousands of logs from assorted systems. USM Anywhere enables you to manage those logs and, through the use of rules, you can prevent and frustrate attacks. The management of the different USM Anywhere rules helps you to make the most of your environment.
Keep in mind that setting up a rule base is an iterative process. That means it happens relatively slowly and needs to be tuned over a period of time. There are always new attacks and new indicators to monitor.
USM Anywhere includes these rules: