Views:

Create a custom model to define the specific events that you want to trigger Workbench alerts.

Important
Important
You can create a maximum of 50 custom models.
Custom models are composed of basic information, the user-defined custom filter, and other parameters, such as the number of events required to trigger an alert and how often the filter query is applied to your activity data.

Procedure

  1. In the Detection Model Management app, go to Custom Models.
  2. Click Add.
  3. Specify the general settings of the model.
    • Model name
    • Description
    • Severity
      Important
      Important
      Selecting a severity of Medium or higher affects the Risk Index in Executive Dashboard and Operations Dashboard.
      During testing and tuning of the model, select a severity of Low to avoid inadvertently affecting your indexes.
  4. Configure the event filtering settings.
    1. Select a filtering mode.
      • Single Filter: The custom model applies only one filter.
      • Multiple filters: The custom model applies multiple filters.
      • Multiple filters in sequence: The custom model applies multiple filters in the specified order.
    2. Select a custom filter in the Filter name menu.
      Selecting Create custom filter opens the Custom Filter Settings screen in a new browser tab. After creating the new custom filter, return to the previous browser tab and select the filter.
    3. If you selected Multiple filters or Multiple filters in sequence, repeat the previous step to add multiple filters.
      You can add up to 5 filters.
    4. If you selected Single Filter mode, specify the Threshold to determine the number of events that must occur to trigger an alert.
      The threshold must be greater than 0.
  5. Specify the event grouping.
    • Company: Trigger an event when the threshold is met anywhere in your organization.
    • Endpoint: Trigger an event when the threshold is met and associated with a single endpoint.
      Only the 10 endpoints with the most matched events are included in the event.
    • User account: Trigger an event when the threshold is met and associated with a single user account.
    Note
    Note
    To reduce alert fatigue, Workbench alerts only include the top targets with matched events.
    For example, if you group by Endpoint, alerts will include only the top 10 endpoints with the highest number of matched events.
  6. Specify the model schedule.
    1. Frequency: determines how often the model queries the activity data.
    2. Period: determines the span of time that is queried each time the model is used.
      Specifying a period greater than the frequency causes the filter to be applied to previously queried data. This might cause the same event appearing in multiple alerts.
    3. Select the Status whether to enable the custom detection model after saving the settings.
  7. Click Save.
When enabled, custom models continuously search for matched events.