Known behavior rules

Some alerts are noise you have already investigated: a scanner you run on purpose, a backup job that trips a rule every night. Mark one as known behavior and Mobius turns it into a reusable, environment-scoped rule that L1 triage consults on every run — so you never triage that same pattern twice.

Mark an alert as known behavior

On an alert's detail page, click Mark as known behavior. The dialog opens pre-filled with conditions taken from that alert, anchored on its Wazuh rule.id and scoped to its environment.

Choose hard or soft

Mode	Behavior
Hard	Auto-closes a matching alert and skips the model entirely — no tokens are spent.
Soft	Adds your reason to the model's prompt as known-behavior context and lets the model still decide.

If both would match, hard wins.

Tune the conditions

Each condition is a field, an operator, and a value:

• The field is any promoted column (such as src_ip or src_user) or a dotted wazuh_source path.
• Operators cover exact match, lists, CIDR ranges, substring, regex, time of day, and day of week.
• Add or remove rows freely — a rule matches only when every condition holds.

A single known user is never enough on its own; combine it with a source and a time window.

Set a reason and an expiry

Give the rule a plain-language reason and an optional expiry. From then on, matching alerts are handled automatically. Every rule lives on the known behavior page, where each shows how many alerts it has handled and when it last matched.

Revoke when it no longer applies

On the known behavior page, Revoke stops a rule from matching immediately while keeping its audit trail and match history. A rule past its expiry stops matching on its own.

note

Any member of your team (admin or user) can mark alerts as known behavior. Rules are scoped to a single environment and private to your tenant.

For context that should inform triage rather than bypass it — what a host does, which windows are normal — use the knowledge base instead.