Import and Export MPE Rules

When you import or export custom rules:

They can be exported from one deployment and imported to another.
They can be imported/exported from LogRhythm to a deployment.
The import and export LogRhythm Client Console version must match.
The import KB version must be equal to or greater than the export KB version.
Any new custom objects are created on import.
They always import with the status set to Development and must be manually promoted.
MPE Policies must be updated after import to enable new rules.
The rules can be imported regardless of the MPE Rule's ID.
Users can validate imported log source types or create new ones if there are not matching log source types.

When you import or export system rules:

The import and export LogRhythm Client Console version must match.
If the rule exists in the import environment, it is overwritten and new dependent objects are created.
If the rule does not exist in the import environment, it and all new dependent objects are created.
Imported system rules are overwritten when the KB in the import environment is updated.

On the Tools menu, click Knowledge, and then click MPE Rule Builder.
The Rule Builder window appears.
Do one of the following:
- Export.
  1. On the main toolbar, click the folder icon.
  2. Locate the custom rule you want to export. You can only export one rule at a time.
  3. Double-click the rule to open it in the Rule Builder window.
  4. On the File menu, click Export.
    If you have the right permissions, a browser window opens.
  5. Select the location where you want to save the exported rule.
  6. Click OK.
- Import.
  1. On the File menu, click Import.
  2. Select the files you want to import. You can import one or many at one time.
  3. Click Open.
    
    You can download MPE rules by going to the LogRhythm Community, clicking on the Shareables link on menu at the top of the page, and then click on the Log Sources option. The filters allow you to choose from supported and unsupported plugins, as well as ones created by LogRhythm or by other users.