Playbook: How to trigger all custom rules, but not built-in rules

You should be able to separate these based on the rule type rather than the rule name.

For Chronicle rule alerts, Google exposes Rule.ruleType with two relevant values:

custom
curated

So for the playbook I would use an Alert-scope Custom Trigger and check the alert field/placeholder corresponding to the rule class (ruleClass / Rule.ruleType) for:

custom

That should allow alerts from custom rules while excluding Google curated/built-in rules. Google documents Custom Trigger as supporting placeholder-based matching.

One caveat: if ruleClass is not exposed in the Custom Trigger placeholder picker in your tenant, the Chronicle Alerts Connector itself supports this exact Dynamic List filter:

Rule.ruleType = custom

But that is a connector ingestion filter, so curated alerts would not be ingested through that connector at all—not simply excluded from this particular playbook.

So I would check for ruleClass in the Custom Trigger first. That preserves the built-in alerts while preventing this playbook from attaching to them.

R.Q / whathehack81

Hi, thanks for your answer. However, I can't find the ruleClass entity in my custom trigger.

I tried to find the [Rule.RuleType] parameter but apparently in my test cases and alerts, that field doesn’t exist, although I’m pretty sure I’ve seen it before. Not sure why I don’t have it.

However, I found a solution that may help this use case and it is actually really interesting, and I haven’t noticed it until now. If you look closely at the URL when you inspect a curated rule in Google SecOps SIEM, you’ll notice it’s ID (shown in the URL) starts with ur, instead of ru, which is how the rule ID begins in custom rules.

For example, the Rule ID for the curated rule Windows Service Creation via Perflogs is ur_09092e76-94ce-462e-849e-5ccc6658d436. That ID is shared between instances, so you can see it yourself by navigating to https://your-domain.chronicle.security/rules/ur_09092e76-94ce-462e-849e-5ccc6658d436?tab=overview (replacing your-domain with your own chronicle instance domain).

Then, you can use this placeholder in a SOAR playbook to get the Rule ID that generated an alert:

[Alert.SourceRuleIdentifier]

By creating a Custom Trigger that checks if the [Alert.SourceRuleIdentifier] field starts with ru, you’re practically done.

Also, this field is listed by the placeholder builder, so it won’t be hard to select.

As always, this was a quick test for the purposes of this response. I’d encourage you to make further tests.