Rules not visible in Threat Management

[Pelican9091]

If you go to the Threat Mangement > view rules. No rules will show. Is this by design or am i missing something?

[c3s4rfred]

Hi @Pelican9091, there isn't a view rules submenu under Threat Management, maybe you mean Threat Management -> Alerts or Threat Management -> Tagging rules or other submenu available under Threat Management.
Keeping this in mind and answering your question -> no rules will show, everything is fine. That view is for tagging rules, so if you don't have any tag rule created, the view will be empty.

Best regards

[Pelican9091]

Ok thanks, is there a way to check if (custom) rules are working, because i'm getting 0 alerts. And is there a way to integrate custom integrations like sysmon and suricata?

[c3s4rfred]

To check the rules, first you need to access to the web application, enable some integrations, then go to -> Log explorer menu and see if the logs are coming. Also you can access to your instance and see the logs of the
using 'docker ps and docker logs containerId' commands, if there aren't errors, everything is fine. Finally, the custom rules must match with the values coming from the logs. Check our documentation to see how rules works -> https://docs.utmstack.com/Correlation%20Rules/README.html

You can send generic logs via syslog or json to our platform, then you can create your own rules, but actually we don't have dedicated integrations for sysmon or suricata in v 10.x.x

Best regards