Managing Entity Groups

Entity groups are created using predefined templates published by the product admin at the platform level to a tenant. You cannot create new templates at any level; instead, you can use the existing templates to create and configure entity groups based on your needs.

When you create an entity group from a template at the tenant level:

• The risk rules defined in the selected template are inherited and cannot be modified.
• You can define new binding conditions to determine which entities should be included in the group, or use the same conditions defined in the template.

Creating an Entity Group from a Predefined Template

Use the procedure below to create an entity group from a predefined template.

To create an entity group:

1. Navigate to Resolutions → Overview, under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view the list of existing entity groups. If no entity groups exist, you'll see a Create Entity Group button.
3. Click Create Entity Group to open the list of predefined templates in the cards format.
4. Browse the list and click Use this Template next to the entity type template you want to use.
   This opens the Create Group From Template page.

Note: To view templates by entity type, use the Group Templates filter. You can also use the search bar to find a template by name.

5. Specify the following information. All fields are pre-populated based on the selected template. You may modify all fields except the risk rules.
   • Name: Keep or change the name of the entity group.
   • Description: Provide a brief description outlining the purpose or context of the group.
   • Entity Type: By default, the entity type is set based on the selected template in the group. Available options are User, Host, or Generic. Any group created with an entity type other than User or Host is categorized as a Generic entity group.
   • Membership Policies – Define conditions to dynamically include entities that meet the specified criteria. These conditions help ensure the group remains contextually relevant. 

6. Click Add Policy. This opens the Add Policy side sheet.

7. Enter a description for the policy.

8. Click Add Conditions to define the criteria that determine which entities are included in the entity group. You can add multiple conditions as needed.

9. Click Preview to view the entities that match your conditions. This opens the Preview side sheet, displaying all matching entities. Once reviewed, click Close to exit the side sheet.

10. Click Done to close the Add Policy side sheet.

11. Modify the risk rules. You can edit the risk rules inherited from the template or add new ones based on your requirements. These rules are mapped to MITRE ATT&CK® tactics and techniques and define the risk behaviors entities in the group may exhibit. The Risk Rules table includes the following details:

• Tactic – The adversary's objective or goal that the entity’s behavior may align with.
• Technique – The method or approach used by an adversary to achieve the tactic.
• Sub-technique – A more specific variation of a technique, describing the exact way the adversary implements it.
• Description – A brief explanation of the potential risk associated with the behavior.
• Risk Severity – The severity level assigned to entities in the group. The likelihood and impact scores are set based on the values you define in the rule.

12. After editing or adding rules, click Done to save the risk rules.

13. Click Submit to create the entity group. Entities that match the specified conditions for User, Host, or Generic types will appear in their respective widgets—Total Users, Total Hosts, or Total Entities.

Entities are organized into three types of entity groups. The details and widgets available may vary depending on the group. Click a group to view its entity insights.

• User Groups. For more details, see Viewing the Summary Tab of User Entity Groups.
• Host Groups. For more details, see Viewing the Summary Tab of Host Entity Groups.
• Generic Groups. For more details, see Viewing the Summary Tab of Generic Entity Groups.

Editing an Entity Group

Follow these steps to modify the details of an existing entity group:

1. Navigate to Resolutions → Overview under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view the list of existing entity groups.
3. Select the entity group you want to edit.
   The Summary page for the selected group opens.
4. Click the kebab menu (three vertical dots) and select Edit.
   You are redirected to the Entity Group page.
5. Modify the desired details of the entity group.
6. Click Update to save your changes.

Deleting an Entity Group

Use the following steps to delete an entity group permanently:

1. Navigate to Resolutions → Overview under the Entities section.
   The Entities Overview page appears.

2. Click the Groups tab to view the list of existing entity groups.

3. Select the entity group you want to delete.
   The Summary page for the selected group opens.

4. Click the kebab menu and select Delete.
   A confirmation modal appears.

5. Click Yes to confirm and permanently delete the entity group.