Trigger Workbench alerts based on user-defined event filters.
Custom Models (
) lists your organization's custom detection models.Custom models consist of:
- Basic information
- A user-defined custom filter
- The number of events required to trigger an alert
- How often to apply the filter query to activity data
- Other parameters
The following table outlines the actions available on Custom Models:
Action
|
Description
|
||
Add a custom model
|
Click Add to create a custom model.
|
||
Filter custom models
|
Use the Search filters to locate specific detection models.
|
||
Enable or disable a model
|
Toggle to enable or disable the detection model
|
||
Edit a custom model
|
Click the edit icon (
![]()
|
||
Delete custom models
|
Select the models and click Delete.
Deleting a custom model does not delete the custom filter used by the model.
|