Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Administration
  4. Cylance Endpoint Security Administration Guide
  5. Using CylanceOPTICS to detect and respond to events
  6. Creating custom detection rules
  7. Create and manage detection rules and exclusions
  8. States

States

States are the highest logic level of a CAE rule and have a larger number of required fields.
Field name
Description
Actions
This field contains a list of the objects that are used to define artifacts of interest within a state. For more information, see Artifacts of interest.
ActivationTimeLimit
This field defines how long
CylanceOPTICS
 will wait for events to trigger the event. The recommended default value is -0:00:00:001.
FieldOperators
This field contains the field operators and operands that should be inspected to fulfill the function that is defined in the state. For more information, see Field operators.
Filters
This field defines which event categories, subcategories, and types that
CylanceOPTICS
 should inspect when trying to fulfill a state. For more information, see Filters.
Function
This field contains the logic function that
CylanceOPTICS
 must observe to consider a state to be satisfied. For more information, see Functions.
HarvestContributingEvents
This field defines whether
CylanceOPTICS
 should record the events that satisfy a state. The recommended value is true.
Name
This field defines the name of the state that will be displayed in the UI if the rule is satisfied.
Scope
This field defines the scope in which
CylanceOPTICS
 looks for relevant events. In most cases, the recommended value is global.
States
This field contains a list of one or more state objects. These objects can be chained.