Behavioral Detection Rules

Behavioral detection rules gives you greater control over how you manage EDR behavioral detections.

This feature allows you to customize detection levels to increase your protection or reduce alert noise as needed.

Customizable Detection Levels You can now choose a detection level for your behavioral detections.

• Cautious (Default): Focuses on the most serious threats to minimize false positives.
• Moderate: Casts a wider net to catch more potential threats.
• Aggressive: Provides comprehensive coverage with maximum sensitivity for a high-alert environment.

Rule Groups Detections are now organized into eight distinct categories. You can set the detection level globally or for each group individually, from Discovery and Information Gathering to Privilege Escalation and more.

Rule Exceptions For rules that don't target highly malicious behavior, you can now create exceptions to disable specific rules that generate excessive alerts.

This feature is available within the threats section for customers who have Endpoint Detection and Response enabled.

For more information, see our support article.