Content Pack Management

Content packs allow you to manage a combination of rules with an easy classification search and analyze the huge volumes of logs to detect the threats in your enterprise IT infrastructure.

Packs allow you to define, customize and combine your own rules in order to detect complex threats in highly complicated environments which in turn produce intellectual property of an organization and make it commercialize the packs at enterprise level.

By default, only base pack is available in the account, and you can enhance these packs based on the subscriptions you subscribed to. Examples of packs are AWS, Office 365, active directory and exploit etc. 

Configuring Content Packs

The Content pack page helps you search all packs by pack type. Quickly enable, delete, edit, and disable packs.

User Permissions Required: A Publisher from these categories - Domain, Organization and Tenant can create packs.

To configure a Pack,

1. Navigate to Configurations --> Chronicle CMS at left menu
2. Click Content Packs tile
3. From the Packs listing page, click+ Add Pack in the top right corner
4. In the Rule creation form, enter Pack Name and add Rules
5. Enter the Company Name, and Company Type
6. By default, Auto Update is enabled
7. Click Save

Note: After you have enabled Auto Update at domain level, a pack is published to organization, and tenant level. You can enable or disable Auto Update at any lower level after publishing a pack. Suppose, if you disable Auto Update at organization level, changes in pack will not be sent to tenant level.

Publishing Content Packs 

User Permissions Required: A Publisher from these categories - Domain, Organization and Tenant can publish packs.

To publish a pack,

1. Navigate to Configurations --> Chronicle CMS at left menu
2. Click Content Packs tile.
3. From the Packs listing page, click on the following options.

• • Publish to All: The pack and the associated rules will be published to all users under each category - Domain, Organization, and Tenant.
  • Publish to Selected: The pack and the associated rules will be published to only selected users under each category - Domain, Organization, and Tenant.

Note: After publishing a pack at domain level, the pack name and rules are not editable at organization and tenant level.

Finding Content Packs

The free text search filters content packs by text in the Pack Name, and/or Company Name and/or Company Type. There is no Search button.

Filtering Content Packs

The content packs can be filtered using the following entities such as: 

Filter	Description
Tags	Keywords that are added to a pack. This includes tactics, techniques, malwares etc.info associated to a pack
Name	Name of a pack
Company Name	Name of an organization that the user belongs to.
Assigned To	The personnel who are assigned to a pack
Comments	Notes added by the users
Created On	The Date and Time on which the pack is created for the first time
Created By	The person who creates the pack
Last Updated By	The person who updated a pack recently.
Last Updated On	The time at which the last update is done to a pack
Auto Update	An update that enables/disables automatically
Rule (Rule List1)	Name of a rule that the pack is filtered. A list of rules is shown in the filter
Updates Available	New changes available or not
Company (Company List)	An organization that a pack belongs to

You can add multiple filters and click Apply to filter your chosen entities. 

You may remove specific filters by clicking and then clicking the X to the right of the filter. To reset the content packs page to its default filters, click Filter --> Clear Filters.

Sorting Content Packs

The packs feed lists all content packs (Published, Publishing and Draft) in the listing page after creating or publishing them. You can sort the packs based on the following list of options.

Item	Description
Last Modified On	Date and Time of last change to a pack
Company Name	Name of a company from which a user is logged on
Name	A name that is given to a pack
Most Used	Most users used the pack
Created On	Date and Time when a pack is created first time
Company Type	A type that a company belongs to

To rearrange the content packs in descending or ascending order, click or

For viewing left side menu, click three dots at the top right corner of screen and select Toggle Sidebar.

For sharing a URL, click three dots at the top right corner of screen and select Share URL.