> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/plans/add-plan.md). # Add Plan Click **Add Plan** in the upper-right corner of the [plan overview](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/plans.md#plans-overview) to create a new plan. The **Hosts** → **Advanced Persistent Threats** → **Plans** → **Add** view opens.

Click **Add Plan** after you configured all settings to save and create the new plan. Click **Back** to return to the overview. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Plan**, all configured settings will be permanently lost. {% endhint %} *** ## General Settings Here you can configure various basic settings.

The following options are available:

Option	Description
Name	Enter a meaningful name for the plan.
Description	Provide a more detailed description for the plan. This field is optional.

*** ## Assigned Hosts Here you can define the hosts or groups of hosts to which the configured settings should apply.

The following options are available:

Option	Description
Hosts	Define the hosts to which the configured settings should apply. Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly. Click the Remove icon next to an added host to remove it from the Hosts field.
Tag Logic	Define how many tags an assigned host must have for the settings to apply to it. The default tag logic is All Tags are Present in the Reference. Click the Tag Logic field to expand a list of all available options. The following options are available: All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it. At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.
Tags	Define tags for groups of hosts to which the configured settings should apply. Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly. Click the Remove icon next to an added tag to remove it from the Tags field.

Option

Description

Hosts

Define the hosts to which the configured settings should apply.

Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly.

Click the Remove icon next to an added host to remove it from the Hosts field.

Tag Logic

Define how many tags an assigned host must have for the settings to apply to it.

The default tag logic is All Tags are Present in the Reference.

Click the Tag Logic field to expand a list of all available options.

The following options are available:

All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it.
At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.

Tags

Define tags for groups of hosts to which the configured settings should apply.

Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly.

Click the Remove icon next to an added tag to remove it from the Tags field.

### Excluded Hosts Here you can define which hosts or groups of hosts should be explicitly excluded from the configured settings. {% hint style="info" %} Defining excluded hosts is optional. {% endhint %} Click **Define Exceptions** next to **Assigned Hosts** to show the options for **Excluded Hosts**.

Configure all settings as described for an assigned host. *** ## Assigned Rules Here you can select specific rules or a group of rules that should be assigned to the plan.

The following options are available:

Option	Description
Rules	Define rules that should be assigned to the plan. Click in the Rules field to expand a list of all available rules and select one or more rules. Alternatively, use the free-text input to find rules in the list more quickly. Click the Remove icon next to an added rule to remove it from the Rules field. Leave the Rules field empty if you want to add a group of rules using tags.
Tag Logic	Define which tags an assigned rule must contain for the setting to apply to it. The default tag logic is All Tags are Present in the Reference. Click in the Tag Logic field to expand a list of all available options. The following options are available: All Tags Are Present in the Reference: An assigned rule must contain all specified tags for the setting to apply to it. At Least one of the Specified Tags Is Present: An assigned rule must contain at least one of the specified tags for the setting to apply to it.
Tags	Define tags for groups of rules that should be assigned to the plan. Please note: The default tag is Managed. This means that all of the more than 7,000 managed rules are used by default to scan for APTs. Click in the Tags field to expand a list of all available tags and select one or more tags. Alternatively, use the free-text input to find tags in the list more quickly. Click the Remove icon next to an added tag to remove it from the Tags field. Leave the Tags field empty if you want to select one or more specific rules by name.

Option

Description

Rules

Define rules that should be assigned to the plan.

Click in the Rules field to expand a list of all available rules and select one or more rules. Alternatively, use the free-text input to find rules in the list more quickly.

Click the Remove icon next to an added rule to remove it from the Rules field.

Leave the Rules field empty if you want to add a group of rules using tags.

Tag Logic

Define which tags an assigned rule must contain for the setting to apply to it.

The default tag logic is All Tags are Present in the Reference.

Click in the Tag Logic field to expand a list of all available options.

The following options are available:

All Tags Are Present in the Reference: An assigned rule must contain all specified tags for the setting to apply to it.
At Least one of the Specified Tags Is Present: An assigned rule must contain at least one of the specified tags for the setting to apply to it.

Tags

Define tags for groups of rules that should be assigned to the plan.

Please note: The default tag is Managed. This means that all of the more than 7,000 managed rules are used by default to scan for APTs.

Click in the Tags field to expand a list of all available tags and select one or more tags. Alternatively, use the free-text input to find tags in the list more quickly.

Click the Remove icon next to an added tag to remove it from the Tags field.

Leave the Tags field empty if you want to select one or more specific rules by name.

### Excluded Rules Here you can define which rules or groups of rules should be explicitly excluded from a plan. {% hint style="info" %} Specifying excluded rules is optional. {% endhint %} Click **Define Exceptions** next to **Assigned Rules** to show the options for **Excluded Rules**.

Configure all settings in the same way as when defining an [assigned rule](#assigned-rules). *** ## File Paths Define file paths that should be scanned on an assigned host. {% hint style="info" %} Specifying file paths is optional. {% endhint %} Click **Add Field** to add a field for defining a file path.

Option	Description
File Path	Enter a file path. You can use wildcards (*) here.
Delete	Click the Delete icon next to an added file path to remove the respective path from the rule.
Add Field	Click Add Field to add the file path to the rule and show another field for defining an additional file path.

### File Path Exceptions Define file paths that should be explicitly excluded from a scan. {% hint style="info" %} Specifying file path exceptions is optional. {% endhint %} Click **Add Field** to add a field for defining a file path.

Configure all settings in the same way as when [defining a file path that should be scanned](#file-paths). *** ## Scheduled Execution Click in the **Advanced Settings** field to define more detailed settings for running an APT scan assigned to the plan.

The following options are available:

Option	Description
System Capacity Utilization	Define the system load that a scan assigned to the plan should consume. This determines how highly the scan is prioritized on a system. The default selected system capacity utilization is Balanced. Click in the System Capacity Utilization field to show a list of all available options. The following options are available: Minimum: The scan should consume only a minimum amount of system performance (max. 1 thread on 1 CPU). This means that it is assigned very low priority on highly loaded systems. Balanced: The scan should consume a medium amount of system performance (approx. 25% load). This means that it is performed with medium priority on highly loaded systems. Moderate: The scan should consume slightly more system performance (approx. 50% load). This means that it is assigned a higher priority even on highly loaded systems. Maximum: The scan should consume the maximum amount of system performance (100% load, all available CPUs). This means that it is assigned the highest priority even on highly loaded systems.
Maximum File Size (in MB)	Define the maximum size of a file in megabytes (MB) to scan. The default file size is 1024.
Scheduled Execution	Define whether the plan should be executed automatically on a regular basis. Please note: Since APT scans generate high system load, we recommend that you perform a scan of all files on the hard drive no more than once per week. Select the checkbox next to Scheduled Execution to define a custom schedule for execution using the time interval selection, or deselect the checkbox to disable scheduled execution.

Option

Description

System Capacity Utilization

Define the system load that a scan assigned to the plan should consume. This determines how highly the scan is prioritized on a system.

The default selected system capacity utilization is Balanced.

Click in the System Capacity Utilization field to show a list of all available options.

The following options are available:

Minimum: The scan should consume only a minimum amount of system performance (max. 1 thread on 1 CPU). This means that it is assigned very low priority on highly loaded systems.
Balanced: The scan should consume a medium amount of system performance (approx. 25% load). This means that it is performed with medium priority on highly loaded systems.
Moderate: The scan should consume slightly more system performance (approx. 50% load). This means that it is assigned a higher priority even on highly loaded systems.
Maximum: The scan should consume the maximum amount of system performance (100% load, all available CPUs). This means that it is assigned the highest priority even on highly loaded systems.

Maximum File Size (in MB)

Define the maximum size of a file in megabytes (MB) to scan.

The default file size is 1024.

Scheduled Execution

Define whether the plan should be executed automatically on a regular basis.

Please note: Since APT scans generate high system load, we recommend that you perform a scan of all files on the hard drive no more than once per week.

Select the checkbox next to Scheduled Execution to define a custom schedule for execution using the time interval selection, or deselect the checkbox to disable scheduled execution.

### Time Interval Selection With the time interval selection, you can configure a custom time interval in which the plan is executed automatically on a regular basis.

The following options are available:

Option	Description
Time Zone	Define the time zone that you want to use for the selected time interval. Click the Time Zone field to expand a list of all available time zones, and select a time zone.
Cron Expression (Vixie/Unix)	Shows the defined interval as a cron expression. The cron expression is updated automatically whenever you configure a time interval manually. Click the Cron Expression field to edit the cron expression manually.
Next Execution (Local Time Zone)	Shows the exact date and time of the next execution in your browser’s local time zone.
Description	Shows the defined interval for recurring execution as a plain-language description.
Time Interval Selection	Define a custom execution interval. Select the relevant minutes, hours, days of the month, months, or days of the week.

***