Practice with Sample RulesPractice with Sample Rules
NetWitness comes with sample rules so analysts can become familiar with how rules look before they create their own rules. Use the sample rules to become familiar with the Rule Builder and to practice editing and deploying a rule.
Sample rules are installed in the Rule Library, which contains every rule you download or create. The following figure shows sample rules in the Rule Library.
These are the available sample rules:
- SAMPLE - Blacklist - From inside countries that are not the US, Non SMTP Traffic on TCP Port 25 Containing Executable
- SAMPLE - Non SMTP Traffic on TCP Port 25 Containing Executable
- SAMPLE - P2P Software as Detected by an Intrusion Detection Device
- SAMPLE - User Added to Admin Group Same User su Sudo
- SAMPLE - Whitelist - From outside of Germany, P2P Software as Detected by an Intrusion Detection Device.
Each name begins with SAMPLE to distinguish the rules that are installed with NetWitness from the rules you download and create.
Rule LibraryRule Library
The Rule Library shows the following information for a rule:
- Name summarizes the data or events the rule collects.
- Description explains the rule in more detail, although only the beginning shows in the Rule Library.
- Trial Rule indicates if trial mode is enabled or disabled for the rule.
- Type shows the origin of the rule, built in Rule Builder or Advanced EPL, downloaded from RSA Live, or Endpoint Rule Bundle.
Practice with Sample RulesPractice with Sample Rules
- Go to
(Configure) > ESA Rules.
The ESA Rules view is displayed with the Rules tab open. - In the Rule Library, double-click a sample rule or select a sample rule and click
.
The rule is opened in Rule Builder. - To practice with a sample rule, refer to the following topics for detailed descriptions and procedures:
- To familiarize yourself with the Rule Builder user interface, see Rule Builder Tab for a description of each field.
- To learn how to edit a rule, see Add a Rule Builder Rule for a step-by-step procedure.
- To deploy sample rule, see Deploy Rules to Run on ESA to learn how to associate the rule with an ESA service.
After you practice with sample rules, you will be able to download, create, and deploy your own rules.
