Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Tuning the Active Rules That Generate CRE Events

The Custom Rules Engine (CRE) event report shows which active rules generate CRE events. In many cases, a rule response is configured to generate CRE events, along with the offense or without it. The report shows which CRE events were generated most by which rule. In general, if the event is generated many times per day, the rule is firing too often. Consider tuning the rule. For example, 1 or 2 Source IPs in the report are related to all the CRE events generated by the rule. The Source IP might need to be added to one of Host Definition BBs that are referenced by the rule. Select the rule and click Investigate to see which Host Definition to update.

You can also use this report to test the rules. In this case, the rule response does not include the offense creation, only the CRE event dispatch. If the report shows that the rule is firing too often, consider tuning it. If you're using CRE events to test the rule, and the number of generated CRE events is only a few per week, change the rule response to generate an offense.

Unapplied filter tags appear in the filters row with a lighter colored background. After you apply the filters, the tags change to a darker colored background.

  1. From the main menu, click CRE Report.
  2. Filter the rules according to the calendar, or by time period.
  3. Select the number of results to return, and click Apply Filters.
  4. Review the CRE events by rule and the CRE events by category and rule reports.
    1. Hover over the chart segments to see more details about an offense.
    2. Hide or show chart legends.
    3. Click the legend keys in the CRE events by rule report to fine-tune the chart display.
    4. Zoom in for further investigation.
    5. Expand the CRE events by category and rule chart to full screen.
    6. Export the CRE events by category and rule chart to CSV, PNG, or JPG formats.
    7. View the CRE events by category and rule chart data in tabular format. Then, export the data in CSV format to view offline or share with colleagues.
  5. Tune the rules by choosing from the following methods:

    1. Toggle between the topmost noisy rules or all the rules from the list.

    2. Add another rule to investigate by selecting a group of rule or an individual rule from the list.

  6. Click Investigate.

    1. Review each individual rule and the BBs that contribute to the CRE event. For each rule, you can further investigate it by clicking Show dependency tree or Edit in rule wizard.

    2. Use the visualization diagram to further fine-tune any related options for the rule or building block, such as log source types, custom properties, or reference sets.

    3. Review the events that are generated by the current rule you selected.

    4. To instantly refresh the rules from QRadar, click the Refresh icon. Otherwise, the app automatically updates data from the Console every 15 minutes.

    5. Review the threshold values in the tests, and tune if necessary.

    6. Review the values in the various groups of tests, and tune if necessary.

    7. Review the MITRE ATT&CK mappings for the rule, and edit if necessary.

    8. To add custom rule attributes to the selected rule or building block, see step 9 in Investigating QRadar rules and building blocks.

    9. To investigate QRadar User Behavior Analytics rules, see Investigating user behavior analytics rules.

    10. To return to the CRE events page, click CRE Report in the breadcrumbs.

  7. To export selected rule data in the report to CSV format to process or view in Excel, select the relevant checkboxes and then click Export.

Related Documentation