Submitting Custom Rules

When you want to submit custom rules for future use into the Attest extension, follow these simple steps. Submitting custom rules is done by specifying a name for the rule set for future selection purposes, and pasting in the properly-formatted JSON text file content into text entry fields, then clicking a button to save and use them.

Before you begin: Refer to the Attest Custom Rule JSON file example in the Custom Rules topic within this documentation.

To submit custom rules:

  1. Open DevTools, click the WorldSpace tab, then select the Rules item from the main menu. For more information, see Opening the Attest Extension, and Rules.
  2. In the left pane, click the + Add a ruleset button in the Custom Rulesets section of the menu.
  3. The Ruleset form appears in the right pane.

  4. In the Name of Custom Rules field, enter the desired alphanumeric name with no spaces, as desired.
  5. Note:

    This will appear in the Custom Rulesets section of the left pane of the Rules panel, so the name should be meaningful and easily recognizable for selection.

  6. In the Enter JSON field, paste in the content of your custom rules .json text file from the virtual clipboard. Grab and drag the lower, right corner of the field to increase the viewable area, if desired. For an example of a custom rules file, refer to the Custom Rules topic.
  7. Click the SAVE AND USE RULESET button.
  8. The Custom Rules panel in FireEyes II, with the two text entry fields populated and mouse cursor clicking on the Submit button

    The name you entered appears in the Custom rulesets section in the left pane, and it appears at the top of the right pane, in the Ruleset: field. Additionally, buttons to either delete or use the ruleset appear at the bottom of the form in the right pane.

    In the right pane, click the Analyze now link.

    The 'Success! Rule data saved.' message appearing at the top right of developer tools

    The custom ruleset name appears in the left sidebar Rules menu preceded by a checkmark to indicate it is the currently-selected ruleset that will be used when performing an analysis.

Next Subtopic: