Add an entity profile rule

You can manage entity profile in Exposure Analytics by adding profile rules and by editing existing profile rules.

To add an entity profile rule, complete the following steps:

1. In Exposure Analytics, select Configure, then Exposure Analytics, then Entity Profile Management.

2. Select Add profile rule.

3. Select the entity type that this rule applies to: Asset or User.

4. Enter a Name and Description for the rule.

5. Select a filter type, choosing from the available filters, and then select Add filter.

   For example, to add a saved asset record filter, select Asset record (R), and then select one of your saved asset discovery filters. To add a metric filter, select Asset metric (M), and then select one of the posture metrics you configured.

   You can add multiple filters, combined with AND. For example, if you select an asset record filter for critical workstations and then add a metric filter for endpoint security, the rule logic is critical workstations without endpoint security.

   Note: You cannot currently combine filters with OR in entity profile rules.
6. (Optional) Select a level for the rule: critical, high, medium, or low. This level is used in the calculation for the entity profile level. The entity receives a profile level that is the highest level from any triggered rules.
7. Select a tag for the rule. This tag will be assigned to entities that trigger the rule, along with tags from any other triggered rules.
8. Select Add.

After you have added the entity profile rules, they will run according to their schedule. By default they will run once per day. You can run profile rules on demand from the Processing searches tab in the Exposure analytics configuration settings.