Skip to main content

Detections

Fluency has a streaming analytics engine, EventWatch, that evaluates records as they arrive. It triggers behavior models (rules) and generates the notifications and notable events that become the risk scores and cases an analyst works from.

The Behavior Rules page​

In the current interface, detections are managed on the SIEM → Behavior Rules page (/SIEM/behaviorRules), with exceptions on Behavior Filters.

Behavior Rules page showing the header buttons, search bar, facet sidebar, and the list of rule cards

The page is titled Behavior Rules, subtitled Listing of Behavior Rules, and has four parts:

  • Title bar — the Behavior Filters and Create Rule buttons on the right.
  • Search bar — a full-width Search field with a Search button and a Sort By drop-down offering Rule Name: A-Z (the default order), Rule Name: Z-A, and Last Updated.
  • Facet sidebar (left) — checkbox groups for Category, Behaviors, Filter, Event Type, and Aggregation Type, each value carrying a count of matching rules, plus a small toolbar of facet actions (a red X Reset Facet, a blue pencil that opens the Search Facets editor, and a blue magnifier Search) pinned to the lower-left corner.
  • Rule list (right) — one card per rule. The top row shows the rule's Name, Category, Tags, an Active toggle, and a three-dot (...) actions button; the body shows the Description, Last Updated, and Matching Behavior Filters.

The ... menu on each card offers View, Clone, View JSON, and Download JSON.

Behavior Filters​

The Behavior Filters button opens the exceptions page at /SIEM/behaviorFilters, titled Behavior Filters with the subtitle Exceptions for Behavior Rules.

Behavior Filters page listing filter rows with enabled toggles and edit and delete actions

It holds a Search field, a red Return to Rules button that goes back to the rules page, a blue Add Wildcard Filter button for creating a filter, and a table of filters with the columns Enabled (an on/off toggle), Name, Description, Behaviors (the behaviors the filter applies to), Created On, and Actions (a blue edit button and a red delete button per row).

A guide to rule writing​

SIEM rules differ based on purpose:

  • Rules that recognize an incoming alert.
  • Rules that supplement missing detection.
  • Rules targeting anomalies.
  • Rules looking for gaps in the rules themselves.

Writing rules for a SIEM differs in that a SIEM often receives already-processed alerts. This is the most common situation when getting audit logs from security devices.

In this section​

The complete catalog of shipped rules is published separately on the rules manual site: https://rules.fluencysecurity.com.