> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules.md). # Rules Rules for Advanced Persistent Threats (APT) are based on what is known as YARA rules, an open-source framework for detecting and classifying malware. They allow you to search files and directories for suspicious patterns that might indicate that your systems are infected with APTs in a targeted manner. {% hint style="info" %} The Enginsight platform currently provides approximately 7,100 managed YARA rules from leading providers, prefiltered by criticality. These rules are automatically updated and extended every 24 hours. {% endhint %} *** Navigate to **Hosts** → **Advanced Persistent Threats** → **Rules** to show a list of all managed and custom rules.

The [rule overview](#rules-overview) provides information such as: * who the provider of a managed rule is. * which criticality the APT detected by the rule has. You can also [add new rules](#adding-a-rule). *** ## Navigation Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly. Click the **Refresh** icon above the list to update all list items. Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages. ### Filtering the List

Available filters

Parameter	Type	Description
Vendor	String	Filter by a specific provider of a rule or exclude it from the results. All available providers are shown.
Severity	String	Filter by a specific severity that is assigned to a rule or exclude it from the results. All available severity levels are shown.
Tag	String	Filter by a specific tag that is assigned to a rule or exclude it from the results. All available tags are shown.

### Sorting List Items Click the **Sort** icon next to a column name in the table header to sort by that column in ascending or descending order . Click the sort icon above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority. ### Deleting List Items Select the checkbox next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items. The number of selected list entries is now displayed next to the search field. The **Delete** button also appears in the upper-right corner. Click it, then confirm the message that appears by clicking **Delete**. {% hint style="danger" %} **Please note:** Deleted items cannot be restored. {% endhint %} *** ## Rules: Overview The rules overview is structured as a table.

The following information is shown:

Column	Description
Severity	Shows the severity assigned to the respective rule. The following severity levels can be shown: Critical: The rule has a very high criticality. High: The rule has a high criticality. Medium: The rule has a medium criticality. Low: The rule has a low criticality.
Rule	Shows the name of the rule, an additional description if provided, and the date and time of creation and last edit. The tags assigned to the corresponding rule are also shown, if available. Click the name of a rule to navigate to the respective edit view. Here you can adjust configured settings and delete the rule.
Vendor	Shows the creator of the rule.
Managed	Shows whether the respective rule is managed by Enginsight or not. If the rule is managed, this is indicated by a green check icon . Unmanaged rules, meaning custom rules, are indicated by a red circle icon .

*** ## Adding a Rule Click **Add Rule** in the upper-right corner to [create a new rule](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules/add-rule.md). *** ## Rule: Edit View Click the name of a rule to navigate to the respective edit view. Here you can adjust [configured settings](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules/add-rule.md#settings) and delete the rule. The following actions are available:

Option	Description
Save Changes	Click Save Changes after adjusting any settings. Please note: Unsaved changes cannot be recovered.
Back	Click Back to return to the list overview.
Remove	Click Remove, then confirm the prompt that appears to delete the object that you are editing. Please note: Deleted objects cannot be recovered.

***