Skip Navigation

Create a detection rule set

Create and apply a detection rule set to configure the types of events that you want
Optics
to detect and how you want
Optics
to respond to those events. A default detection rule set is available to help you test and evaluate how you want to use detection rules. In the default rule set, all detection rules are turned on and automated responses and user notifications are turned off.
When you create a detection rule set, it is a best practice initially to turn on the desired detection rules without response actions and desktop notifications. After you evaluate the detections data, you can configure the appropriate response actions and user notifications for each rule.
For more information about the optional
Optics
rules that you can import for your organization’s environment, see KB76816.
  1. In the management console, on the menu bar, click
    CylanceOPTICS > Configurations
    .
  2. Hover over
    Configurations
    on the top menu bar and click
    Detection Rule Sets
    .
  3. Click
    Create New
    .
  4. Type a name and description.
  5. If you want the
    Optics
    agent to display a message when a rule is triggered on the device, in the
    Detection Notification Message
    field, type the message.
  6. Review the available rules. For each rule, you can hover over the information icon to view a description. Click
    ON
    to enable an entire rule group or a specific rule.
  7. If you want to display a desktop notification when a rule is trigged on a device, select the
    Display Detection Notification on Device
    check box for the rule.
  8. If you want the
    Optics
    agent to execute a response action when a rule is triggered on a device, in the
    Response
    drop-down list for the rule, select one or more actions. You can hover over the information icon for each action to view a description.
  9. In the
    Device Policy
    drop-down list, click one or more device policies that you want to assign the detection rule set to.
    You can also assign a detection rule set to a device policy when you create or change a device policy.
  10. Click
    Confirm
    . Review the summary then click
    Confirm
    again.
After you assign the detection rule set to a device policy, you can view and manage detections. You can also do any of the following optional tasks: