Rule Settings
The Settings tab holds the settings that describe the rule itself, rather than its query, its schedule or the notifications it sends.
Level and Status
| Field | Description |
|---|---|
| Level | The severity of the rule. |
| Status | How reliable the rule is. |
Neither is mandatory. A rule that sets neither produces detections without them, which is how every rule created before these settings existed behaves.
Both are written to every detection the rule produces, whatever its processing type, and both are available to notification email templates as {{ level }} and {{ status }}.
Level describes how urgent a detection from this rule is, so that whoever receives it can prioritise.
| Level | Meaning |
|---|---|
| Low | Little urgency. Worth recording, but not worth interrupting anyone for. |
| Medium | Ordinary priority. |
| High | Should be looked at ahead of lower level detections. |
| Critical | The most urgent. Reserve it, or it stops meaning anything. |
Status describes how much the rule can be trusted, which tells an analyst how much weight to give a detection and how many false positives to expect.
| Status | Meaning |
|---|---|
| Experimental | An early-stage rule that may be incomplete. Expect more false positives. |
| Testing | More mature than an experimental rule. Actively being validated in real environments. Expect some false positives. |
| Stable | Considered production-ready. Has been thoroughly tested across multiple environments. Expect a reasonable false positive rate. |
| Deprecated | An outdated or superseded rule that may rely on old techniques or assumptions. Generally avoid using these in production. |
Note
Include Rule Documentation
| Field | Description |
|---|---|
| Include Rule Documentation | Whether the rule’s documentation is included in the detections it produces. |
The content of the rule’s Documentation tab is written to each detection as detailedDescription, which means it leaves Stroom with the detection, for example by email.
Untick this where the documentation is for whoever maintains the rule rather than for whoever receives its detections.
See Also
Feed for Errors
| Field | Description |
|---|---|
| Feed For Errors | The
Feed
Feed
A Feed is a means of organising and categorising data in Stroom. A Feed contains multiple Streams of data that have been ingested into Stroom or output by a Pipeline. Typically a Feed will contain Streams of data that are all from one system and have a common data format. Click to see more details... that errors occurring during execution are written to. Use Set Default to use the feed configured for the system. |
See Also
Reports
A Report has a Settings tab of its own, holding Feed For Errors along with the settings that decide what kind of file it produces.
A report has no Level, Status or Include Rule Documentation, because it delivers a file rather than detections.