Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-detection-rules

Customization rules

You can create two types of customization rules in Sophos XDR: custom detection rules and detection suppression rules.

To see your customization rules, go to Security Operations > Rules.

Custom detection rules

Custom detection rules create detections from normalized events in Sophos XDR using an advanced search query. For more information, see Custom detection rules.

Detection suppression rules

Detection suppression rules resolve detections as suppressed when they're created, so they don't appear by default on the Detections page. For more information, see Detection suppression rules.