Rule reports help the user monitor rule performance.
Rule reports present information about the
Falcon Expert rules and the relevant analysis. Each rule defines a set of conditions; for instance, a rule fires if the condition is met for a transaction with a score above a certain level and if it occurs in a particular location.
Covered Topics Accessing Rule Reports Falcon Expert provides one rule report. Other rule reports are available in Case Manager . The reports can give you insights into your rules and how they are used. Generating and Configuring Expert Rule Reports ruleReport shell script is a utility that generates rule reports. The granularity of the report is at the level of a tenant. You can find the script on the Scoring Server in the RuleAuthoring/util directory. Rule Detail Report Rule Summary Report False Positive Ratio by Rule Report Decision Frequency of Rules Report Decisions by Account Decisions by Service