xenXDRby FluenceSecurity
Book a demo

Writing rules

Create query, threshold, sequence and correlation rules in the editor, and preview what they would raise.

The editor

Detections › New rule opens the editor. It walks through six sections:

SectionWhat you set
Rule typeCustom query (Sigma), search query (XQL), threshold, event query (EQL), correlation, sequence, behavioral or indicator match.
DefinitionThe data source, the field matches are grouped by, and the query, stages or indicator selection.
ExceptionsTelemetry the rule should never match. See Exceptions and suppressions.
AboutName, description, severity, risk score and ATT&CK techniques.
ScheduleHow often the rule runs and how far back it looks.
Response automationThe playbook to run on each alert, and whether the rule starts enabled.

The editor checks the query as you type and shows whether it compiles. A rule that does not compile never fires.

Data source

Pick the source the rule is written for, for example Windows process creation or Okta. With Narrow the query to this source on, the rule only reads that telemetry, which is faster and cannot fire on a source it was not written for.

Query rules

A search query rule uses the Logs page language without pipelines:

text
event.module:sysmon event.code:1
process.command_line:*-enc* process.executable:*\powershell.exe

grouped by host.name. For "at least N" rules, use the threshold type.

Sequence rules

Stages are ordered. Each stage has its own query; all stages must match the same value of the Correlate on field within the window, in order:

  1. event.type:logon_failed
  2. event.type:logon_success
  3. event.type:service_installed

correlated on user.name within 30 minutes.

Correlation rules

Several conditions, matched in any order, each with a minimum count. Useful when sources arrive with different delays.

Preview

Preview matches runs the rule over a recent window and shows how many events match, how many distinct entities and hosts are involved, and how many alerts the rule would raise, with the top entities. Use it before enabling a rule.

Enabling

Choose whether a new rule starts enabled. Sigma imports always start disabled. Enabling and disabling are audited.

Style

  • One behaviour per rule. Rules that catch three things produce alerts nobody can name.
  • Group by the entity that should be blamed, not the one that is convenient.
  • Set the severity for what the match means, not for how rare it is.
  • Write the description for the person who will read the alert, including what to check first.