Creating a Threat Detection Rule

Creating a Threat Detection rules involves naming and configuring the rule, and then starting the rule. In some rule types, you can include multiple values, such as of IP addresses, domain, locations, or email addresses, so you might want to create a Shield list of those values instead of adding all the individual values to the rule.

1. Go to Admin Console > Shield.
2. Click the Detection Rules tab.
3. Click Create Rule ().
4. Click the detection rule type you want to create.
5. On the Create [rule type] Rule page, enter a Rule Name and Description and configure the rule. Specifically:
   • For Malicious Content, decide if you want to enable deep scan and download restrictions.
   • For Suspicious Location, configure locations and content to monitor and decide which filters to enable.
   • For Suspicious Session, decide which filters to enable.
   
   See Box Shield Threat Detection Rule Settings for additional details about the settings for each rule type.
6. Click Next.
7. On the Review [rule name] page, review the rule settings.
8. Click Start Rule ().