Managing Findings Rules

Editing a Findings Custom Rule

You can edit the configuration of a Findings Custom rule.

To edit the rule configuration

1. In the Rules Manager table, click a rule.
   Its Rule drawer opens.
2. In the Rule drawer Rule Configuration tab, update parameters or settings (refer to creating a new rule), as required. The Save Changes button becomes enabled.
3. Modify the external notification or Remove the external notification, if required.
4. Click Save Changes.

Modifying the External Notification

You can choose an alternate enforcement action for a different external notification or modify the configuration of the existing one.

To modify the external notification

1. Hover over the defined external notification, and click the Edit icon that appears (see figure below).
2. Modify the configuration of the external notification, by doing one of the following:
   • In Select Action, choose another enforcement action and fill in the required fields.
   • Modify the configuration of the current enforcement action.
3. Click Apply.

Removing the External Notification

You can remove an external notification from a Findings Custom rule.

To remove an external notification

1. Hover over the defined external notification, and click the Trashcan icon that appears (see figure below). The external notification is removed.
2. Click Apply. The external notification is removed from the Findings Notification Enforcements folder in the Enforcement Center.

Activating/Deactivating a Findings Rule

A rule runs only while it is activated. You can activate any Findings Custom rule.

To activate a rule

1. In the Rules Manager table, click a rule, and in the Rule drawer that opens, toggle on Activate (default).
2. Click Save Changes.

To deactivate a rule

1. In the Rules table, click a rule, and in the Rule drawer that opens, toggle off Activate.
2. Click Save Changes.

Deleting Findings Rules

You can remove one or more Findings rules from the table on the FIndings page or remove a single Findings rule from its Rule drawer.

Deleting Rules from the Findings Page

From the table on the Findings page, you can delete one or more Findings rules (Custom rules).

To delete Findings rules

1. In the Rules Manager table, hover over a row of a single rule, and then at the end of the row, click the Delete icon, or select the checkboxes of one or more rules, and then on the top right of the table, click the action.
   A confirmation dialog is displayed with the message: You are about to delete an alert rule. Are you sure? (when you select a single rule to delete) or You are about to delete n alert rules. Are you sure? (when you select n rules to delete).
2. Click Delete to confirm deleting the rules. The rules are removed from the table, and Total decreases accordingly.

Deleting a Rule from the Rule Drawer

You can also delete a single Findings rule from the header of its Rule drawer.

To delete a rule from its Rule drawer

1. In the Rules Manager table, click a rule. The Rule drawer opens.
2. In the Rule drawer header, click .
3. The system asks you to confirm your choice. Once you confirm, the rule is completely deleted from the system.