Create detection rules based on graph search ↗

Prerequisites\
License: This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.

Graph Search requires View or View/Edit RBAC permissions for Graph Search under Investigation & Response → Search.

The Graph Engine is a Cortex detection method that identifies threats by analyzing relationships between entities rather than evaluating individual events in isolation.\
The engine periodically queries a contextual security graph that represents your environment as:

• Nodes, such as identities, configurations, code repositories, data stores, and cloud resources.
• Edges and paths, which represent the relationships and access routes between those entities.\
  Graph detection rules evaluate these relationships to identify risky combinations and potential attack paths. When a rule matches, the Graph Engine creates a live, evidence-backed issue in the Cortex issues experience.

The Graph engine includes system graph rules by default. You can also create your own custom rules to identify attack paths in your organization.

Key characteristics

• Detection type: Graph-based detection that evaluates relationships and paths between entities.
• Cyclic evaluation: Graph rules run periodically rather than evaluating each event as it arrives. By default, the engine runs every 6 hours.
• Path-based issue: Each issue is uniquely identified by the rule ID and the graph path that triggered it. This allows the engine to track matching paths across evaluation cycles and automatically close issues generated by outdated rule versions.
• Rule output: The Graph Engine creates issues that appear in the Cortex issues experience.

Create a detection rule based on a graph search

A graph detection rule tells the engine what pattern of connected entities to look for in the contextual search graph. Each rule pairs a graph query with metadata, for example, severity, category, description, resolution plan. When the query matches one or more paths in the graph, each matching path triggers a security issue.

To create a rule, navigate to Investigation & Response → Graph Search.

1. Build your query as detailed in Create Graph Search query.
2. In the three dot menu, click Save as Rule.
3. In the New Graph Rule page, under General, add the following details

• Main Settings:
  • Name: A unique name for the rule.
  • Description: A description of the rule.
  • Labels (optional): Add labels to the rule.
  • Severity: Select a severity level for the issue that will be triggered.
  • Remediation (optional): Provide remediation instructions.
• Compliance Controls (optional): Select a control from the controls catalog.

1. In the Condition page, the graph query you have built is displayed. You can use the relevant options to edit your query. For more information about how to build your graph query, see Create Graph Search query. Use Generate Preview to view the results of your query.
2. In The Summary page, review the rule and click Save.

After the rule is synced and enabled, the Graph engine picks it up on the next cycle and triggers issues for every matching path.

View and manage Graph rules

To view the Graph generated rules, in Posture Management → Rules & Policies → Rules → Cloud Security, filter the Rules widget by Graph. Manage the graph rules using the right click actions:

• System rules: Disable
• Custom rules: Disable, Edit, Save as, Delete

Click each row in the table to view the rule details in the side panel. To view the results of the query, next to the query click Show in Graph Search. The panel also displays any issues generated by the rule, affected assets, linked cases, and the graph evidence.