Activating Rules from the Rule Library
Qualys Context XDR offers an extensive out-of-the-box library of rules for you to leverage. These rules are built on a variety of MITRE tactics and techniques.
On the Context XDR UI, navigate to Rules > Rule Library to view all the pre-configured rules. The Rule Library page displays the MITRE tactic and technique used for each rule along with its criticality. It also displays the type of log sources each rule is applicable to.
To activate a rule from the Rule Library, use the Quick Activate option from the corresponding Quick Actions menu on the Rule Library page.
To view the details of a rule, use the View details options from the corresponding Quick Actions menu. The rule details page describes each rule in detail. It also displays the signal condition in natural language for easy understanding. To activate a rule from this page, click Quick Activate from the Actions menu on the top-right corner.
Qualys Context XDR allows you to build your own rules by leveraging existing rules from the Rule Library. To configure an existing rule from the Rule Library, follow these steps:
1. From the Rule Library page, click the Configure and Activate option from the rule’s Quick Actions menu.
Note: You can select multiple rules to configure before activating and select Configure and Activate from the Actions menu.
2. The Configure and Activate page displays a list of all the rules you’ve selected.
3. Click Edit from the Actions column to edit a rule. See the Create a New Rule section for information on configuring the rule.
4. Finally, click Activate on the Configure and Activate page to activate the selected rules. The activated rules are displayed on the Rules sub-tab.
You can also watch out the following tutorial to know about Rule Library:
Related Topics