Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說明書
Additionally, the system may import non-local rules. As a non-limiting example, analysts create and validate non-local rules (e.g. YARA rules) to identify new threats as they emerge and as old threats are updated. These non-local rules are automatically imported to the system as they become available over a network service. In some embodiments, the system may not allow a user to modify the non-local rule after they are imported, whereas other embodiments may allow a user to modify some or all of the non-local rules. Additionally, the system may disable sharing a non-local rule, or a rule cloned from a non-local rule, with the community exchange. Once imported, the system may prepend a string to the non-local rule, such as “PM_” to identify the rule as a non-local rule.
In addition to rules imported from other network services (i.e. community rules and non-local rules), rules may also be imported from a file. Rules can be created from other rules by cloning. Cloning a rule simply copies all elements of the rule. Rules may also be edited or deleted at any time via the rules module.
Recipes Module
