Advanced Mode

Create and edit nested rule criteria conditions using advanced AND/OR logic.

This help topic assumes you understand how to use all Criteria controls in Simple mode.

Overview

Some customers need the flexibility to define rule criteria with advanced AND/OR logic options. When the Criteria section is in Advanced mode, controls allow you to define conditions/condition groups preceded by AND/OR logic.

AND Logic

• ALL conditions in the condition group preceded by AND need to be present in the event

• Use AND to add a very narrow (filtered down) rule

OR Logic

• Only ONE condition in the condition group preceded by OR needs to be present in the event

• Use OR to create a broader rule that can match with various use cases

Example: Using Advanced Mode

This image shows Advanced Mode criteria for the following rule: Data | Sensitive or Encrypted data shared externally or publicly.

The primary condition group is AND, which means specifies that the file sharing event visibility is public/external AND the event must also have one of the nested OR conditions: Data Violation is Credit Card Information with Terms OR File Insights is File Encrypted.

Using Advanced Mode

Most controls in Advanced mode are identical to the controls in Simple mode. This section describes only controls unique to Advanced mode.

Enable Advanced mode

1. Click the Advanced mode toggle switch in the rule editor’s Criteria section.

2. 

3. All existing configurations will display in Advanced mode (save for any match all conditions.)

You can now use controls to create and nest conditions under AND/OR logic are now available.

Add a Condition Group

A Condition Group is a set of conditions preceded by AND or OR.

1. Expand a group’s Add Condition menu, then select Add Condition Group

2. 

3. Controls to define a new condition group will display.

4. 

After a condition group is added, you can define the logic for the condition group and add conditions to the group.

Define AND/OR Logic for a Condition Group

1. Expand the AND/OR menu that precedes a condition group and select either AND or OR

2. 

3. All items in the condition group will be evaluated according to the selection.

AND means the rule must match with ALL items in the condition group

OR means the rule need to match only ONE item in the condition group

Delete a Condition Group

1. Click a condition group’s option menu

2. Select Delete condition group

3. 

The condition group (and all conditions in the group) are removed.

Add a Condition

1. Expand a condition group’s Add Condition menu, then select Add Condition

2. 

3. Controls to define a new condition will display.

4. 

5. Define the condition (as you would in Simple mode), then click the checkmark to Save.

Add or remove conditions as needed.

Add a Nested Row to a Condition

You can add nested rows to any condition group, or add a nested row to a single condition to turn it into a condition group.

1. Hover over a condition, expand its options menu, and click Add nested row

2. 

3. A nested condition is now available for you to define.

4. 

5. Be sure to define AND/OR logic for the condition group

6. Add or remove conditions from the group as needed.

Delete a Condition Group

1. Click a condition group's option menu and select Delete condition group

2. 

3. The condition group (and all conditions nested in it) are removed.

Exit Advanced mode

You can not exit Advanced mode if advanced conditions are defined in the rule editor. (Toggle switch will be grayed out)

1. Remove any nested condition groups from the rule editor.

2. Set the primary logic to AND.

3. Switch the Advanced mode toggle to off.

4. The remaining conditions will display in Simple mode.