Views:

Add custom detection signals that are unique and critical to your environment.

Procedure

  1. On the Detection Signals tab, click Add.
  2. Specify a name for the signal and optionally provide a description in the Basic Properties area. The name can help clearly identify what signals deviating from normal behaviors that you want to detect.
  3. In the Signal Definition area, define the signal.
    1. Select a condition field from the drop-down list.
    2. Select the desired operator from the drop-down list.
      Available operators include both integer value comparison operators and string value matching operators. For example, ≤ means that the condition field contains an integer that less than or equal to the specified integer value.
    3. Enter or select the desired value as a string or integer if necessary.
      The following table describes the supported conditions:
      Condition Field
      Operator
      Description
      Sender address
      • Is In
      • Is Not In
      The sender's email address is or is not in the specified email address list.
      A maximum of 50 email addresses is supported.
      The asterisk (*) wildcard is supported to represent zero or more characters in the local part and domain of an email address, for example, *@example.com, name@*.com, and *@*.example.com
      Sender domain registration age
      ≤
      The sender's domain in the From header field of an email was registered for less than or equal to the specified number of days.
      Default value: 7. Range: 1 - 366. Unit: days.
      For example, setting the value to 1 means that the sender domain has just been registered within the past 24 hours.
      Sender domain activity within the past 30 days
      ≤
      The sender's domain in the From header field of an email has exhibited activity for less than or equal to the specified number of days in the past 30 days.
      Default value: 5. Range: 0 - 30. Unit: days.
      For example, setting the value to 0 means that the sender domain has not shown any activity in the past 30 days.
      Sender address activity within the past 30 days
      ≤
      The sender's address in the From header field of an email has exhibited activity for less than or equal to the specified number of days in the past 30 days.
      Default value: 5. Range: 0 - 30. Unit: days.
      For example, setting the value to 0 means that the sender address has not shown any activity in the past 30 days.
      Reply-To domain activity within the past 30 days
      ≤
      The recipient's domain in the Reply-To header field of an email has exhibited activity for less than or equal to the specified number of days in the past 30 days.
      Default value: 5. Range: 0 - 30. Unit: days.
      For example, setting the value to 0 means that the Reply-To domain has not shown any activity in the past 30 days.
      Reply-To address activity within the past 30 days
      ≤
      The recipient's address in the Reply-To header field of an email has exhibited activity for less than or equal to the specified number of days in the past 30 days.
      Default value: 5. Range: 0 - 30. Unit: days.
      For example, setting the value to 0 means that the Reply-To address has not shown any activity in the past 30 days.
      URL domain registration age in email
      ≤
      The domain of any URL in an email was registered for less than or equal to the specified number of days.
      Default value: 30. Range: 1 - 366. Unit: days.
      For example, setting the value to 1 means that the domain of at least one URL in an email has just been registered within the past 24 hours.
      URL
      Is In
      The URL in an email matches an entry in the specified URL list.
      A maximum of 1,024 URLs is supported. Separate multiple URLs with a comma.
      Wildcard characters are not supported.
      URLs are normalized before matching: if no protocol is specified, http is assumed, and any query string is removed. As a result, the http and https versions of the same URL are treated as different.
      URL domain
      Is In
      The domain of a URL in an email matches an entry in the specified domain list.
      A maximum of 1,024 domains is supported. Separate multiple domains with a comma.
      Wildcard characters are not supported. The domain must match exactly; for example, sub.example.com does not match example.com.
      Final URL domain registration age
      ≤
      The domain of the final URL in an email was registered for less than or equal to the specified number of days. The final URL is the destination reached after following any redirects or shortened links.
      Default value: 30. Range: 0 - 366. Unit: days.
      For example, setting the value to 1 means that the domain of the final URL has just been registered within the past 24 hours.
    Note
    Note
    Currently, you can configure only one condition in the signal definition.
  4. View and confirm that the signal definition meets your requirement.
  5. Click Save.