Rule Management

How to edit an existing rule

To edit the configuration of an existing rule, take the below steps.

1. Navigate to the Configuration tab for the rule.
2. Update the rule configuration by editing the rule settings.
3. Add or remove input signals from the rule by clicking the signal selector icon in the Input Signals section. Note: you may only select signals of the same type as were originally used to configure the rule.
4. Click the Monitoring action menu and click Start monitoring. This will save the new settings for the rule. Note: if the page is refreshed or you log out of Falkonry before starting monitoring on the new settings, any changes you have made will be reverted to the previous settings.

How to disable a rule

To disable a rule, click the Monitoring Action Menu and select Stop Monitoring. This will stop the system from generating rule assessments and alerts.