Rules, Building Blocks, and Offense Management
Exam items test rule logic, reusable building blocks, and the offense lifecycle.
Core rules
- Rule types include event, flow, offense, and common rules. Building blocks are reusable condition sets referenced by other rules; they are not meant to create offenses themselves.
- Actions include Create Offense, Dispatch Event, Notify, Email, Syslog, and Custom Action.
- Offense magnitude combines severity, credibility, and relevance; offense retention and closing are configured separately from event retention.
- Test rules before deploying; broad rules create noise and consume EPS. Use thresholds and building blocks to keep logic readable.
Worked example
A building block matches failed logins; a parent event rule uses it with a threshold of five in ten minutes and creates an offense. The parent stops firing after the building block is disabled, even though the parent looks correct. Re-enable the building block, deploy, and retest with Rule Test. The reasoning: the parent has no independent condition, so the nested block is the trigger.
Traps
- Expecting a building block to generate offenses on its own.
- Editing a rule and testing before deployment; the old version is still active.
- Setting thresholds that are too low and flooding analysts.
- Forgetting that offense retention is separate from event retention.
- Using a custom action without the script present on every processor.