Lookout Rules

Lookout rules are specific vendor alerts, or signal, that the SOC analysts flag for a closer look in your environment. Lookout rules may not be a threat, but they certainly need to be evaluated. For example, SOC analysts can create lookout rules for specific users in your environment who could be targets because of recent press coverage.

Like suppression rules, lookout rules are created by SOC analysts both for your specific environment and for all customers.

The following is a list of lookout rules:

Rule	Action
Always Expel alert	If a vendor alert matches this rule, Ruxie generates a new Expel alert.
Add to	If a vendor alert matches this rule, Ruxie adds an Expel Alert to an existing investigation or incident.
Always Expel alert & add to	If a vendor alert matches this rule, Ruxie generates a new Expel alert and adds that new Expel alert to an existing investigation or incident.

Lookouts will also have one of two statuses:

Status	Color	Meaning
Active	Green	The lookout is active for your environment.
Expired	Gray	The lookout is inactive for your environment.

You can view lookout rules by going to Detections > Lookouts. Along the top of this screen, you can also use the various lists to sort the results.

You can only view the lookout rules; you cannot edit or change any of them. If you see a lookout rule you have a question about, disagree with, or want removed, select Copy link to rule and paste it into a message for our Support team.