Managing Rules
The "Selection Criteria Panel" (opened by clicking a rule's white space) and its screenshot are from an older version of the interface, and are not part of the current SIEM → Behavior Rules page, where a rule's definition is opened with the card's ... menu (View or View JSON). The current page also does not document a per-rule delete control. The management practices below still apply.
The Behavior Rules page (SIEM → Behavior Rules) lists all the rules being processed by the EventWatch engine, one card per rule.
Each card's top row shows the rule's Name, Category, Tags, an Active toggle, and a three-dot (...) actions button; the body shows the Description, Last Updated, and Matching Behavior Filters (a dash when no filters match).
The ... button opens the card's actions menu, which holds four options: View, Clone, View JSON, and Download JSON.
Duplicating a Rule
It is best practice to duplicate a rule prior to editing it. As many rules are first implemented via the "resource sync", editing the default rule exposes the rule to be overwritten if there is a change in the default rule.
It is best to duplicate the rule (the Clone option in the rule card's ... menu), edit it, and then deactivate the original rule with its Active toggle.
Clone opens the Add Behavior Rule dialog pre-filled from the source rule: the Name field holds the source rule's name with _clone appended, and the description, tags, event type, and search profile carry over. The Bucket Category selector starts empty, so pick one before saving.
Deactivating the Original
An active rule shows a green Active toggle with a check mark. Click it to switch the rule off; the toggle turns into a red X.
Deleting Rules
Just like it is best to duplicate a rule to prevent an overwrite, it is best to deactivate a rule instead of deleting it. A rule you should delete is one that was written only for this instance and is not a default rule. Deleting a default rule means that the rule, when updated, will be written back into the system and activated.
Editing a Rule
As noted above, it is best to use a combination of first duplicating a rule before editing it. Editing the rule will push the rule into production when saved.