Manage rules using the Rules Editor

To use the Rules Editor to create and edit rules, follow these steps:

1. Click Detections > Rules & Detections > the Rules Editor tab.

2. Use the Search rules field to search for an existing rule. You can also scroll through the rules using the scroll bar. Click any of the rules in the left panel to view the rule in the rule display panel.

3. Select the rule you are interested in from the Rules List. The rule is displayed in the rule editing window. By selecting a rule, you open the rule menu and can select from the following options:

   • Live Rule—Enable or disable the rule.
   • Duplicate Rule—Make a copy of the rule; helpful if you want to make a similar rule.
   • View Rule Detections—Open the Rule Detections window to display the detections captured by this rule.

4. Use the Rule Editing window to edit existing rules and to create new rules. The Rule Editing window includes an automatic completion feature to enable you to view the correct YARA-L syntax available for each section of the rule. Whenever composing or editing a rule, Google Security Operations recommends walking through the automatic recommendations to ensure your completed rule uses the correct syntax. To update the rule scope, select the scope from the Bind to scope menu. For more information about associating a scope with a rule, see data RBAC impact on Rules. For more information, see YARA-L 2.0 language syntax.

5. Click New in the Rules Editor to open the Rules Editor Window. It automatically populates it with the default rule template. Google SecOps automatically generates a unique name for the rule. Create your new rule in YARA-L. To add a scope to the rule, select the scope from the Bind to scope menu. For more information about adding a scope to rules, see data RBAC impact on Rules. When you have finished, click SAVE NEW RULE. Google SecOps checks the syntax of your rule. If the rule is valid, it is saved and automatically enabled. If the syntax is invalid, it returns an error. To delete the new rule, click DISCARD.

6. To view information on the current detections associated with a rule, click the rule in the rules list and click View Rule Detections to open Rule Detections view.

   The Rule Detections view displays the metadata attached to the rule and a graph showing the number of detections found by the rule over recent days.

7. Click Edit Rule to return to the Rules Editor.

   Multicolumn view

   The Timeline tab is also available and lists the events detected by the rule. As with the Timeline tab in other Google SecOps views, you can select an event and open the associated raw log or UDM event.

   You can also manipulate what information is displayed on the Timeline tab by clicking the Columns icon to open the multicolumn view options. Multicolumn view lets you select a variety of categories of log information to display, including common types such as hostname and user and many more specific categories provided by UDM.

8. Click RUN TEST to run the rule displayed in the rule editing window. Google SecOps begins to collect detections. This gives you a quick way to check if the rule is working as expected. The detection information is displayed in the TEST RULE RESULTS window. At any time you can click CANCEL TEST to stop this process.

For Community blogs on managing rules, see:

• Rules Editor Navigation

Need more help? Get answers from Community members and Google SecOps professionals.