- Go to Threat Exchange > Business Rules. A page appears showing previously configured business rules (if applicable).
- Click Create New Rule. This opens a window where the rule can be given a descriptive name and a set of matching conditions selected. The boolean logic allows for
not,and, andorfunctions for more than one rule to match on metadata provided about the IoC, including source, reputation, tag, severity, extended information, and many more.
- Select an Entity. Choose Threat Indicators to build the rule on the IoCs in Threat Exchange, or choose a Risk Exchange entity to build it on that entity’s records. The matching conditions and the field mapping both follow the entity you select, so changing it resets the rule you have built so far. The entity cannot be changed after the rule is saved.
Map Entity Records to IoCs
When a rule is built on a Risk Exchange entity, a field mapping defines how a matching entity record becomes an IoC. Map the IoC fields to the fields of the selected entity. Value, Type, and Expires At are required, and cannot be changed after the rule is saved. If the entity has no text field suitable for the IoC value, switch the field to Static and enter a fixed value instead.
IoCs created from entity records are labelled with the rule that produced them rather than a source plugin, and they are not retracted. Retraction applies only to IoCs pulled by a source plugin.
- You can add more rules and create groups of rules that can be additive or alternative. Rules can also be deleted by clicking on the rule and selecting the red garbage can.
- Finally, rules can also be copied from the IoC page for use in a business rule by clicking on the Copy Filter button, or created from the IoC page by clicking on the document icon.
- Enter the folder name that you want to add the rule(s) to or select an existing folders. At max Cloud Exchange supports a business folder hierarchy three levels deep.
- When finished, click Save. Whenever a rule is saved or deleted, a green pop-up box will appear in the upper right corner reporting successful completion of the command.
Perform Actions on Business Rules
You can manage all the business rules from the Business Rules page. Write-access users can mute one or multiple business rules, and also clone an entire business rule, edit the query for business rules, or delete the business rules from this page. These Actions are explained in more detail below.
The number of rules shown on the page can be modified if there are more than 10 to show.
 |
Clone a Business Rule
To clone a business rule, click the document icon on the rule and confirm the action. The clone is built on the same entity as the original.
 |
Mute a Business Rule
Muting can be used to temporarily ignore any new IoCs that would normally trigger sharing.
 |
Edit a Business Rule
To edit a business rule, click the pencil icon on the rule and make your changes. When finished, click Save. The entity a rule is built on cannot be changed.
 |
Test a Business Rule
To test a business rule to see its matching the number of IoCs from a given period of time, select the sync icon on the rule and confirm the action. This will display the total number of IoCs matching this Business Rule. For a rule built on a Risk Exchange entity, the count is of matching entity records.
 |
- Enter the Time Period (in days). Only the IoCs fetched during this period will be considered while evaluating the business rule. Checking the All Time button will evaluate all active IoCs for the past 365 days.
- Click Fetch. This will invoke the test; it will not result in the IoC being shared. Actually sharing IoC requires configuring a sharing rule.
This will show the qualified number of URL(s) with size and qualified number of Filehash(es) with size.
Delete a Business Rule
To delete a business rule, click the trash icon on the rule and confirm the action.
 |
Add, Edit or Delete Exception Rules to a Business Rule
Exception rules are used to exclude specific indicators based on some criteria. For example, you can exclude indicators with low severity or specific value, as well as create exception rules with query or tags.
Exceptions work like the business rules, and can use query language, or particular tags, making it easier to remove certain kinds of data from the primary matching rule. For example, the IoCs that have been tagged as benign by the SecOps team.
To create an Exception Rule, expand the rule and click the Exception Rules + icon.
 |
Enter an exception rule name and add queries or tags. When finished, click Save.
 |
Other actions that can be taken on exception rules include:
- Editing existing rules by clicking on the pencil icon.
- Deleting rules by clicking on the garbage can icon.
A business rule on this page is built on a single entity. To build a rule on records joined from Threat Exchange and Risk Exchange together, create a unified mapping business rule in Universal Schema Builder > Business Rules.