Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說明書
A drag and drop rules editor interface can be provided so that parameters from a reported message can be selected and incorporated into a rule. The rule content 1330 can be inserted by a string editor, allowing a user to input a string as rule content 1330. The string input is one of text, a hexadecimal string, or a regular expression (regex). The system may then create rules, such as YARA rules, based on the user inputted strings. As a user inputs additional rule content 1330, the system will continuously attempt to match the rule against any currently open reports. If the rule module is accessed from a cluster, the rule module will attempt to match the newly created rule against all reports in the cluster and provide a visual indicator to the user as the rule content is input (e.g. through color coding upon a match). Furthermore, the administrator may select for the rule to be matched against the message or against the attachment 1340.
