Cisco
Login
Search
Software Secure Workload
Activity Configure

Configure and Monitor Forensic Events Forensic Configuration Forensic Rules Adding a Forensic Rule

Last updated: Jun 09, 2025

Adding a Forensic Rule

This section explains how to add new forensic rules.

Before You Begin

You must login as Site Admin, Customer Support or Scope Owner in the system.

Procedure

1

In the navigation bar on the left, click Defend > Forensic Rules.
2

Click Create Rule.
3

Enter the appropriate values in the following fields.

Field

Description

Rule Name

Enter a name for the rule. Name cannot be empty.

Ownership scope

Enter an ownership scope for this rule.

Actions

Select actions when this rule is triggered. Record means matching security events persist for further analysis. Alert action means to publish matching security events to Secure Workload Alert system.

Severity

Select severity level of this rule: LOW, MEDIUM, HIGH, CRITICAL or REQUIRES IMMEDIATE ACTION

Clause

Enter a rule clause. A clause must contain security event signals from either a process forensic event or a workload event. A clause is invalid if it contains both process and workload signals.
Create rule
Figure 1: Create rule
4

Click Save.
Previous topic Forensic Rules Next topic Basic Forensic Rule Composition