How to manage threat definitions

Summary

This article describes how to manage threat definitions. Threat definition contains detection logic to search for threats in your environment. 

Some threat definitions have parameters to configure such as lists of exclusions, time period or lists of predefined roles, groups, or other entities. Threat definition can be disabled if you accept the risk or threat definition is not relevant for your environment. 

Cayosoft constantly works on updating threat definitions. Recent versions of threat definitions can be installed over-the-air without need to upgrade the product version.

How to change parameters in threat definition

1. Open Cayosoft Guardian Web Portal.
2. Expand Threat Detection node.
3. Select Threat Definitions.
4. Select a threat definition and press Properties.
5. Change parameters.
6. Press Save.

How to disable threat definition

1. Open Cayosoft Guardian Web Portal.
2. Expand Threat Detection node.
3. Select Threat Definitions.
4. Select a threat definition and press Properties.
5. Select Disabled checkbox.
6. Press Save.

How to update threat definitions manually

With paid subscription, Cayosoft Guardian updates threat definitions automatically. With free subscription, only manual update is available.

1. Open Cayosoft Guardian Web Portal.
2. Expand Threat Detection node.
3. Select Dashboard.
4. In the Live update widget press Check for updates.