Threat Command Policy Rules

Use Threat Command rules to enforce a remediation or other actions on an alert. As opposed to global policy rules, Threat Command rules enable more specific search criteria and additional activities.

You can create rules (also called policies) that will apply actions to all alerts of a specific alert type or to a subset of those alerts that match defined criteria.

All Threat Command policies include these parts:

• To which alerts to apply the policy - Which alerts match the criteria, as you define in the Alert Profile tab.
• What to do to the matching alerts- You define this in the following tabs:
  • Internal remediation - Share alert indicators with integrated security devices. For example, if a phishing website alert contains IOCs, you can share those with an integrated device for blocking, etc. This option is available for some alert scenarios, such as phishing, credentials leakage, Twitter, and others.
  • External remediation - Request a takedown, close alerts, and report malicious sites.  The available options change per alert scenario.
  • Actions - Assign alerts, add watchers, change severity, add tags, send an email, and close the matched alerts.

The steps of creating a policy are a) to define to which alerts to apply the actions and b) to define what to do to the matching alerts.

By default, rules act on new alerts. After defining a new rule, you are given the option to include past alerts in the defined actions.

Create a Threat Command policy

You can use Threat Command rules to match alerts more exactly and to perform internal or external remediation (where applicable).

To create a Threat Command policy:

1. From the Automation > Policy  page, click the Threat Command alert type to create.
2. Click the + sign.
3. Type a name for the rule. 
4. Use the Alert Profiletab to define to which alerts to apply the policy actions:
   1. By default, all alert scenarios will match. To limit that, select from the Alert Type list.
      The options of alert scenarios depend on the Threat Command rule that you are creating.
   2. You must select at least one of the alert severittes to match from the Alert Severity list.
   3. (Optional) To further define the matching alerts, select from the General Conditions list.
      The conditions depend on the alert scenario that you selected.
      The most common conditions are described in the General conditions table. There are additional conditions specific to particular scenarios, described in the Alert type conditions table.
5. Click Next.
   The Internal Remediation tab is shown. Internal remediation is available for some alert scenarios.
6. (Optional) Configure internal remediation:
   1. Select Share alert indicators with devices.
      The list of integrated devices is shown, together with IOC groups that were predefined for each device.
   2. Select devices and the IOC groups to share per device.
      You can also create IOC groups on-the-fly, described in Automate Internal Remediation.
      Selected IOC groups are displayed in the IOC Groups selected panel.
7. Click Next.
   The External Remediation tab is shown. External remediation options vary per alert scenarios.
8. (Optional) Configure external remediation:
   1. To initiate a takedown, select one of the available options.
   2. To automatically close matching alerts after they have been successfully remediated, select Close alerts after successful remediation.
   3. To warn others about potentially malicious websites, select to which agency to report them.
9. Click Next.
   The Action tab is shown.
10. Select actions to perform on matched alerts.
11. Click Finish.
    When prompted, you can include past alerts, even alerts that are closed.
12. (Optional) To include historical alerts, select a time frame and whether to include closed alerts, then click Yes, include. Otherwise, click No thanks.

When the rule is accepted, a confirmation message is displayed, and the rule is shown in the rules list.

View current Threat Command rules

• From the Automation > Policy **** page, click a Threat Command alert type. 
  Rules that have already been defined are displayed in the rules list for the selected alert type.

You can edit, duplicate, delete, and stop a rule. For more information, see Editing Policy Rules.

General conditions table

The following table describes the general conditions that apply to most alert scenarios:

* Use the "Negate" option to find the opposite, for example, alerts whose source date is not within a range, or that do not have tags.

Not all of the general conditions apply to every alert type, and they are sometimes displayed in a different order.

Some alert scenarios use other conditions, described in the Alert type conditions table.

Alert type conditions table

The following table describes conditions that apply to only some scenarios (in alphabetical order):

* Use the "Negate" option to find the opposite, for example, alerts whose source date is not within a range, or that do not have tags.