Known behavior rules
Some alerts are noise you have already investigated: a scanner you run on purpose, a backup job that trips a rule every night. Mark one as known behavior and Mobius turns it into a reusable, environment-scoped rule that L1 triage consults on every run, so you never triage that same pattern twice.
Mark an alert as known behavior
On an alert's detail page, click Mark as known behavior. The dialog opens
pre-filled with conditions taken from that alert, anchored on its Wazuh
rule.id and scoped to its environment.
Choose hard or soft
| Mode | Behavior |
|---|---|
| Hard | Auto-closes a matching alert and skips the model entirely, at no cost. |
| Soft | Hands your reason to the analysis as known-behavior context and lets the model still decide. |
If both would match, hard wins.
Tune the conditions
Each condition is a field, an operator, and a value:
- The field is picked from a list of the common alert fields, such as Source IP, Source user, Agent name or Priority. Custom path (advanced) matches on any other field of the original Wazuh alert.
- Operators cover exact match, lists, CIDR ranges, substring, regex, time of day, and day of week.
- Add or remove rows freely. A rule matches only when every condition holds.
A single known user is never enough on its own. Combine it with a source and a time window.
Set a reason and an expiry
Give the rule a plain-language reason and an optional expiry. From then on, matching alerts are handled automatically. Every rule lives on the known behavior page, where each shows how many alerts it has handled and when it last matched.
Revoke when it no longer applies
On the known behavior page, Revoke stops a rule from matching immediately while keeping its audit trail and match history. A rule past its expiry stops matching on its own.
Any member of your team, admin or user, can mark alerts as known behavior. Rules are scoped to a single environment and private to your tenant.
For context that should inform triage rather than bypass it, such as what a host does or which windows are normal, use the knowledge base instead.