## Overview

**Priority Rules** allow you to automatically adjust investigation priorities based on predefined conditions. When alerts match your criteria, Dropzone sets the investigation priority to the appropriate level— **Urgent**, **Notable**, or **Informational**—without manual intervention.

Priority Rules help ensure that critical investigations receive the right level of attention, while lower-risk or expected activity is appropriately deprioritized.

### How Priority Rules Affect Investigations

With Priority Rules enabled:

- Investigation priorities are automatically adjusted based on your rules
- Default priorities can be overridden using insight tags and conclusions
- Similar alerts receive consistent prioritization
- Analysts spend less time manually triaging priority levels

## Quick Setup

### Step 1: Navigate to Custom Strategies

1. In the Dropzone interface, open **Settings** from the left navigation.
2. Click **Custom Strategies**.
3. You’ll see the Custom Strategies management page with a **New Strategy** button.

### Step 2: Create or Edit a Strategy

- Click **\+ New Strategy** to create a new strategy, or select an existing one.
- In the **Create Strategy** modal:
  - Enter a unique, descriptive strategy title (for example, _High Priority Malware Alerts_).
  - Click **Save**.

You’ll be taken to the strategy configuration page.

### Step 3: Configure Alert Filters

Alert filters define _when_ your Priority Rules should apply.

Configure one or more of the following filters:

- **Scenario**  
  Keywords that appear in alert descriptions (for example, _malware detection_).
- **Attack Surface**  
  Select one or more:
  - Cloud
  - Network
  - Email
  - Identity
- **MITRE Tactic**  
  Choose applicable tactics such as:
  - Initial Access
  - Execution
  - Defense Evasion
  - Or **All**
- **Alert Source**  
  Select specific sources (for example, GuardDuty, Sumo Logic, Email) or **All**.

**Example Filter Configuration:**
- Scenario: _malware detection_
- Attack Surface: _Network_
- MITRE Tactic: _Execution_
- Alert Source: _All_

### Step 4: Configure Priority Rules

Scroll to the **Priority Rules** section of the strategy.

1. Click **\+ Add Condition**.
2. Define the condition:
   - **Has Insight Tags:** Select one or more tags (for example, _Malware_, _Blocked Activity_).
   - **And conclusion is one of:** Select applicable conclusions (for example, _Malicious_, _Suspicious_).
3. **Then, set priority to:** Choose the priority level:
   - Urgent
   - Notable
   - Informational
4. Add additional conditions as needed using **\+ Add Condition**.

## Understanding Insight Tags

**Insight Tags** are automatically applied labels that provide additional context during investigations.

Insight Tags can:
- Restrict or influence possible conclusions
- Provide context without changing outcomes

They help embed domain-specific knowledge into the AI’s decision-making and are often used in combination with conclusions to drive priority decisions.

## Example Priority Rule

**Malware with Confirmed Impact**
- Has Insight Tags: _Malware, Blocked Activity_
- And conclusion is one of: _Malicious_
- Then, set priority to: **Urgent**

## Priority Levels

Priority Rules support the following levels:
- **Urgent**  
  Critical threats requiring immediate attention
- **Notable**  
  Important alerts that require prompt review
- **Informational**  
  Low-priority alerts intended primarily for awareness

## Common Insight Tags

Frequently used insight tags include:
- Malware
- Blocked Activity
- Potentially Unwanted Program
- Account Lockout
- Attack Simulation
- Authorized Scanner
- Conditional Access Block

## Best Practices

### ✅ Do
- Assign higher priority to confirmed malicious activity
- Use multiple conditions to create precise rules
- Test rules using representative alerts
- Consider analyst workload and team capacity

### ❌ Don’t
- Set all investigations to **Urgent**
- Create overlapping or conflicting priority rules
- Ignore investigation conclusions when assigning priority

## Example Priority Rule Configurations

### High-Priority Malware
- Condition:
  Has Insight Tags: _Malware_  
  AND conclusion is _Malicious_  
- Priority: **Urgent**

### Blocked Suspicious Activity
- Condition:
  Has Insight Tags: _Blocked Activity, Potentially Unwanted Program_  
  AND conclusion is _Benign_  
- Priority: **Informational**

### Account Security Events
- Condition:
  Has Insight Tags: _Account Lockout_  
  AND conclusion is _Suspicious_  
- Priority: **Notable**

## What You’ll See in Your Investigations

After configuring Priority Rules:
- **Automatic Priority Assignment**  
  Investigation priorities are set automatically.
- **Consistent Prioritization**  
  Similar alerts receive the same priority treatment.
- **Reduced Manual Work**  
  Analysts no longer need to adjust priorities by hand.
- **Improved Resource Allocation**  
  Teams can focus on the most critical cases first.

## Next Steps
- **Start simple**  
  Create one or two rules for your most common alert types.
- **Test and monitor**  
  Observe how rules affect investigation queues.
- **Refine**  
  Adjust rules based on feedback and workload.
- **Expand**  
  Add more sophisticated prioritization as your team gains confidence.