close
keyboard_arrow_left
Table of Contents
- play_arrow What's New for JSA Users
- play_arrow Capabilities in your JSA product
- play_arrow Dashboard Management
- Dashboard Management
- Default Dashboards
- Custom Dashboards
- Creating a Custom Dashboard
- Using the Dashboard to Investigate Log or Network Activity
- Configuring Dashboard Chart Types
- Removing Dashboard Items
- Detaching a Dashboard Item
- Renaming a Dashboard
- Deleting a Dashboard
- Managing System Notifications
- Adding Search-based Dashboard Items to the Add Items List
- play_arrow QRadar Analyst Workflow
- play_arrow Offense Management
- play_arrow Log Activity Investigation
- play_arrow Network Activity Monitoring
- play_arrow Asset Management
- play_arrow Chart Management
- play_arrow Event and Flow Searches
- play_arrow Custom Event and Flow Properties
- play_arrow Historical Correlation
- play_arrow Juniper Networks X-Force Integration
- play_arrow Report Management
list Table of Contents
Editing Building Blocks
date_range
27-Mar-21
You can edit any of the default building blocks to use it in multiple rules or to build complex rules or logic. You can save a group of tests as building blocks for use with rules.
For example, you can edit the BB:HostDefinition: Mail Servers building block to identify all mail servers in your deployment. Then, you can configure any rule to exclude your mail servers from the rule tests.
- Click the Offenses or Network Activity tab.
- Click Rules.
- From the Display list, select Building Blocks.
- Double-click the building block that you want to edit.
- Update the building block, as necessary.
- Click Next.
- Continue through the wizard.
- Click Finish.
