Create Custom Detection Rules to check your organization’s assets.
Creating Custom Detection Rules give you the flexibility to define and enforce security best practices tailored to your organization's objectives, as well as regulatory requirements not already covered by the compliance standards in our catalog.
Ensure you have a custom compliance control defined to associate the Custom Detection Rule to. For more information, see Use a built-in or custom standard.
Go to → → → .
In the Cloud Workload Rules page, click Create Custom Rule.
Enter the following settings:
Rule name: A descriptive name for the custom rule.
Description: An optional field for adding additional details or context about the rule, such as its purpose or intended behavior.
Select a Scanner to execute the Custom Detection Rule and its associated script. The options are:
Agentless Disk Scan
Kubernetes Connector
XDR Agent
Configure settings specific to the scanner you select.
For Compliance Violation Severity, define the severity level of the compliance violation to ensure proper categorization and prioritization. Possible values are:
Critical
High
Medium
Low
Informational
For Compliance Controls, assign the rule to one or more existing compliance controls.
Note
Only Custom Detection Rules (not built-in rules) can be assigned to custom controls.
Click Add.
Select a custom compliance control from the list.
Click Assign.
For Remediation, you can optionally define the remediation steps to address any detected misconfiguration.
Click Create.
The new rule appears in the Rules List.
You can now use the rule as a check to either create an issue or monitor adherence to a specific requirement.
Create an issue Under → → , add the Custom Detection Rule to a Policy. This policy automatically runs the rule and creates an issue if the check fails.
Monitor compliance adherence Under → → → , create a custom standard that includes the custom control associated with the Custom Detection Rule, and then create an assessment profile that runs the custom standard. You can then monitor the compliance results in a report. For more information, see Monitor and track compliance adherence.