---
id: tailor-global-rule
title: Tailor a Global Rule
sidebar_label: Tailor a Global Rule
description: You can override selected fields in all Cloud SIEM rule types. After you have overridden a field, you can revert to the original field value.
slug: /help/docs/cse/rules/tailor-global-rule/
canonical: https://www.sumologic.com/help/docs/cse/rules/tailor-global-rule/
---
import useBaseUrl from '@docusaurus/useBaseUrl';
This topic has instructions for tailoring [global (built-in) rules in Cloud SIEM](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md).
You can override selected rule fields in all Cloud SIEM rule types: match, threshold, chain and aggregation. After you have overridden a field, you can revert to the original field value.
:::note
You cannot override fields in legacy rules—rules whose ID looks like LEGACY-*xxxxxxx*.
:::
If you want to tailor a rule expression—the expression to which incoming records are compared—see [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions).
## Signal generation fields you can override
You can override any of the settings in the **Then Create a Signal** section on the right side of the rule editor.
| Setting | Notes |
|:--|:--|
| Entity | In the **On Entity** area, you can change the entity or entities upon which signals will fire when the rule is triggered. |
| Signal name | If the **using the name** field is present, you can override the name that will be assigned to signals fired by the rule. |
| Summary | In the **with the summary** field, you can override the description of the situation that causes the rule to fire a signal. |
| Description | In the **with the description** field, you can override the description of what conditions the rule looks for. |
| Severity settings | You can change the severity type from constant to dynamic and vice versa, change the severity level for a constant severity, or change the field used for dynamic severity. |
| Tags | You can add tags, but you can’t edit or delete the tags already configured for the rule. |
})
## “If triggered” fields you can override
You can override some of the fields in the **If Triggered** section on the left side of the rules editor. What you can edit depends on the rule type. The table below lists the rule settings that you can override for each rule type. See [Screenshots](#screenshots) below for a visual overview.
| Rule type | What you can override |
|:--|:--|
| Match | nothing |
| Aggregation | - grouped by—You can add and remove fields to group records by.
- within—You can change the time window over which the aggregation conditions are applied.
|
| Chain | - grouped by—You can add and remove fields to group records by.
- within—You can change the time window over which the aggregation conditions are applied.
|
| Threshold | - matches records with ... values—You can override the number of records that must match the rule expression.
|
## Screenshots
| Aggregation rule | Chain rule | Threshold rule |
|:--|:--|:--|
| })
| })
| })
|
## Reverting overridden settings
You can revert any overrides you’ve made at any time back to the original value (only).
Once you save the overrides to a rule, a revert button appears next to each edited field, as shown in the screenshot below. If you hover over the revert button, you can see what the original value was.
})
To revert an override, just click the revert button next to it. After reverting all desired fields, click **Save Edits** at the bottom of the page.