Rule creation indication
in progress
D
Doug Thomas
From the "elevation events" page, there should be an indication that a rule has already been created from that specific event. Otherwise, you have multiple people that could be wasting time creating the same rule from the same event. This should be as easy as indicating with a field/column of "Rule created" (yes/no) or a visual indication like a green/red dot or a hover-over fly-out that says "rule created".
D
Daniel Rivera
updated the status to
in progress
D
Daniel Rivera
Sorry for the slow reply on this one.
Robby, your suggestion lines up closely with the direction we're taking. The plan is for the Matching Rule column to show a "Created (View Rule)" value when a rule has since been created from that event, linking to the rule, and to drop back if that rule is deleted. It's in testing now, so details may still shift before release.
Matthew, the "a similar rule already exists" check is a separate piece. It's on our list as part of broader rule cleanup and duplicate detection work, but it's at an earlier stage.
R
Robby Swartenbroekx
yes, I really like this one (I was going to propose it). I would suggest using the column that is already there: "Had matching rule". Now it has a value of "No" and "Yes (View Rule)". Maybe add a value "Created (View Rule)" to indicate it has now a rule that matches it, but it hadn't one when it was evaluated.
If you have 5 past events, and you create a rule for one of them, all 5 would be labeled as such. That would mean if that would happen again now, it would have a rule.
D
Daniel Rivera
Merged in a post:
Smart Rule Check
D
Doug Thomas
I may have posted this already in a different request. However, it would be amazing if the AutoElevate platform would indicate to you in some form or fashion that the Elevation Event you are looking at already has a matching rule. This way, we are not wasting time/efforts trying to create rules that already exist. And to take this further, maybe even a compare feature that would compare one rule to another to see the differences. Or some sort of smart notice that might say, "hey this is very similar to another rule, but only the file name is different".
D
Daniel Rivera
Hi Doug — good instinct, you did raise this back in April. I've merged your Smart Rule Check post into this one so the votes and discussion stay together.
Between the two, what's now captured here is: an indicator on the Elevation Events page showing that a rule already exists for an event, a warning when you're about to create a duplicate, and the rule-to-rule comparison / "this is similar to an existing rule, only the file name differs" notice you described. Duplicate rule detection and cleanup is part of what the development team is looking at.
We'll post updates on this thread as it progresses.
M
Matthew Buehlmann
Daniel Rivera - Hey Daniel, just piggybacking on this, specifically for the "similar rule functionality". There are times were we'll get a request for an elevation where we feel there's a very similar rule. We then have to go hunt for that, compare the two rules identify the difference (e.g., the filename or path was different).
Having a way to quickly review "Similar Rules" or see "A similar rule already exists, click here to view more details" would really help with rule management.
D
Doug Thomas
Daniel Rivera thanks for your reply. I have the "had matching rule" column, but that isn't what I am looking for. For elevation events in audit mode I want to see if a rule has been created for those specific events right from the "elevation events" window. I don't want to have to go to the rules and hunt for it. I also don't want my team wasting time creating rules for something that already exists. There should be a column or a visual indication that someone created a rule for that specific event for those audit-mode events. And then if the rule was created and deleted it should show that it was not created. Otherwise, there is no way to tell if a rule was created other than manually trying to check. It would be WAY faster and more efficient if we had this.
An additional request would be to have a notification that shows you if you are creating a duplicate event.
D
Daniel Rivera
Doug Thomas: Thanks for explaining that further. I see what you're saying. Possibly have the "Outcome" column indicate rule created from that event. I will pass this along to our development team and thanks again for that feedback. We are also looking into assisting and cleaning duplicates rules.
D
Daniel Rivera
Hello Doug. Thank you for your feedback. There is a column called "Had Matching Rule?" which indicates this. If "Yes" it will link to the existing rule. If you do not see this column, verify in the "Show Column Chooser" option (crossed out eye in top right) if it is unchecked. Otherwise please reach out to support team at support@cyberfox.com for further assistance.