Configure custom detection rules

Use cases

Custom rules and scan policies serve different purposes: scan policies control "which files in which buckets are scanned," while custom rules control "what conditions trigger alerts for already-scanned files." Custom rules supplement the built-in detection engine and run in parallel with it without interference. A single file may trigger alerts from both the built-in detection engine and custom rules simultaneously. We recommend configuring custom rules in the following scenarios:

• Targeted protection: Specific business directories or file types have known threats, and you need to set detection conditions for these directories or file types to cover known threats that the built-in detection engine does not detect, reducing missed alerts.

• Tiered alerting: Your organization has an existing security response process and needs to set differentiated alert levels and handling priorities for different types of threats.

• Compliance requirements: Industry compliance standards have mandatory alerting and recording requirements for specific types of security events.

• Frequent business changes: Your business or directory structure changes frequently, and you need to dynamically adjust detection rules as your business evolves.

Scope

Before configuring custom rules, you must first purchase and activate the malicious file detection value-added service.

Create a custom rule

1. Access the Security Center console - Risk Governance - Malicious File Detection, and in the upper-left corner of the page, select the region where your assets are deployed: Chinese Mainland or Outside Chinese Mainland.

2. Click Policy Configuration in the upper-right corner of the page.

3. On the Policy Configuration tab, click the Custom Rules tab, and then click Add Rule.

4. In the Add Rule panel, configure the following parameters and then click OK.

   • Rule Status:

     • Default state: Enabled (the rule takes effect immediately after creation).

     • Manual switch: After the rule is created, you can also toggle the switch in the Enabling Status column of the rules list.

   • Threat Tag:

     • Function description: Select the threat tag used by this rule to identify the type of threat detected. Alerts generated after a match will display this tag name.

     • Tag operations: Threat tags are classification labels for custom rules and can be managed through the Threat Tag drop-down list:

       • Add a tag: Click Add Threat Tag in the drop-down list. In the Add Threat Tag dialog box, enter a custom threat tag name and then click OK.

       • Delete a tag: In the drop-down list, click the delete icon to the right of the target tag. In the confirmation dialog box, click OK.

   • Risk Level: Select the risk level of the alert generated when the rule is matched: High, Medium, or Low.

   • Event Description: Enter a description for the alert, up to 500 characters. This description will be displayed in the alert details to help security operations personnel quickly understand the alert.

   • Alert Rule:

     • Matching logic: Configure one or more file matching conditions. Multiple conditions are evaluated with an OR relationship: an alert is triggered when any condition is met.

     • Add a condition: Click Add Rule within this area to add a condition row. Each alert rule condition consists of a condition type, an operator, and a condition value. The supported operators and condition value format requirements for different condition types are as follows:

       Condition type	Supported operator	Condition value format
       File MD5	String Equals	Enter the MD5 hash value of the file.
       File SHA256	String Equals	Enter the SHA256 hash value of the file. Only hexadecimal characters (a-f, 0-9) are supported.
       File Name	String Equals	Enter the complete file path.
       	Fuzzy Match	Enter a file path pattern that contains the * wildcard, such as *malware_test/*, which matches all files in the malware_test directory.

   • Effective Bucket: Select the scope of the rule: All Buckets or Specific Buckets. If you select Specific Buckets, select the target buckets from the bucket list.

     Note

     The effective bucket scopes of multiple rules can overlap.

Edit a custom rule

1. In the rules list on the Custom Rules tab under Policy Configuration, click Edit in the Actions column of the target rule.

2. In the Edit Rule panel, modify the rule configuration. For parameter descriptions, see Create a custom rule.

   Important

   Modifications do not affect historical alerts and take effect only for new alerts.

3. Click OK. After the edit is successful, the rules list displays the updated configuration.

Delete a custom rule

• Delete a single rule

  1. In the rules list on the Custom Rules tab under Policy Configuration, click Delete in the Actions column of the target rule.

     Note

     Only rules in the Disabled state can be deleted. To delete a rule in the Enabled state, first turn off the switch in the Enabling Status column.

  2. In the confirmation dialog box, click OK.

• Batch delete

  1. In the rules list, select the rules you want to delete.

     Note

     Only rules in the Disabled state can be selected. To delete a rule in the Enabled state, first turn off the switch in the Enabling Status column.

  2. Click Batch Delete below the list.

  3. In the confirmation dialog box, click OK.

Next steps

• Run detection: For instructions, see Create and run a detection task to scan files in the target buckets.

• View and process detection results: When a custom rule is matched, an alert is generated. You can view alert details on the At-risk File Overview tab, and based on your business scenario, see Process malicious file alerts to choose an appropriate handling method.