Create New Base MPE Rules
Before you build any MPE rules, it is highly recommended that you attend the rule building training offered by LogRhythm. For information on training schedules, contact your LogRhythm sales representative.
- On the Tools menu, click Knowledge, and then click MPE Rule Builder.
The Rule Builder window appears. - On the main toolbar, click the New icon, and then click Yes to confirm your choice.
The Rule Builder appears. In the General tab in the upper-left quadrant, type a Rule Name.
When naming a rule, follow these accepted best practices:
- When the matching log message contains a vendor message ID such as an event ID in Windows Event Logs, it is good to include the ID in the name of the rule. This makes searching for the rule easier and also makes the rule more descriptive of the log that it matches.
- If the rule matches a log from a logging system that generates logs for a wide variety of services, such as the Windows Application Event Log, the service that generated the log message should be included in the rule name.
- All rule names should contain a brief description of the action described by the log. For example: EVID 528 : Failed Authentication : Bad Username or Password
- To associate the rule with a Common Event, click Common Event.
Click the Rule Status you want.
Type a brief description for the rule.
At the bottom of the quadrant, click the Processing Settings tab and complete the fields.
At the bottom of the quadrant, click the Default Policy Settings tab and complete the fields. Change the following settings as necessary:
Log Data Management Settings. You can choose to override Log Source settings.
Log Processing Settings. Disable Automatic Host Contextualization (AHC). You can also disable AHC on individual sub-rules.
Event Settings. You can choose to forward matching logs to the Platform Manager.
LogMart Settings.
Check the Override Log Source settings check box. The default is unchecked.
Select Forward logs or Don't forward logs. The default is to forward logs.
(Optional) You may click Advanced to select optional fields to store in LogMart. Defaults are shown in the following table.
Field Default Origin Host Fields X Impacted Host Fields X Application X Source Port Destination Port X Protocol X Login X Account X Group X Domain X Object URL Sender X Recipient X
In the Log Message Source Type Association section in the upper-right quadrant move through the tabs to select a Log Message Source Type and any enter additional information you need.
In the center pane of the Rule Builder window, enter the base rule Regular Expression to determine what items are parsed from a raw log.
In the bottom pane of the Rule Builder window, enter the Sub-Rules by right-clicking the open area on the Sub-Rules tab.
Use the Test Center tab to test the Regular Expression on log samples.
Right-click the grid of the Test Center area to display a context menu that contains options to import .LLX files and manually import log messages, including multi-line logs.
The Test Center cannot process rules that have the "Pattern" prefix. For more information, see Rule Processing Logic.
