Skip to main content
Create custom detections with Ask Wirespeed. Describe the activity you care about, and the assistant finds the right data, builds and tests the rule, and shows it to you for confirmation. Custom detections run every 15 minutes. Matches follow the same verdict processing as other Wirespeed detections.

​
How matching works

A custom detection watches one source table and uses a WHERE predicate to decide which events match. A WHERE predicate is simply the filtering part of a SQL query — the conditions that come after WHERE. For example, these conditions match successful email-send events on the microsoft_ual_logs table:
You do not need to include SELECT, FROM, or the WHERE keyword. Wirespeed adds the source table, your team’s metadata, and the time range automatically. Each event that matches the conditions creates one detection. This keeps every detection tied to a real source event, with its original time, integration, and related assets available for investigation. Ask Wirespeed can also check surrounding activity. For example, a rule can match a successful login only when the same user had many failed logins during the previous two hours. The assistant keeps these lookbacks scoped and time-limited so the rule can run reliably.

​
Suppress repeated detections

Some rules can match several closely related events. You can suppress these repeats by choosing:
  • The related asset types to compare, such as users, endpoints, files, IP addresses, or domains
  • A suppression window of 15 minutes, 30 minutes, 1 hour, 4 hours, 12 hours, or 1 day
When the same rule fires again within that window and shares any selected asset with the earlier detection, Wirespeed closes the newer detection. Its timeline explains why it was closed and links back to the original detection. The window starts from the original detection. Closed repeats do not extend it, so new activity can create another detection after the window ends.
Suppression depends on the selected asset being present on the matched event. For example, user-based suppression works only when the event identifies a user.
This makes threshold rules much simpler. A mass-email rule can find users with at least 100 sends in 15 minutes, then use User suppression for 15 minutes. Wirespeed keeps the first detection and closes the additional matches for that user.

​
Before you confirm

Ask Wirespeed checks the connected table and fields, runs the rule against recent data, and shows:
  • How many events matched
  • The source and filtering conditions
  • Query performance
  • Any repeat-suppression settings
Rules must return no more than 100 matches during verification and complete within the production query limits. If a rule is too broad or slow, the assistant narrows it before presenting it.

​
Always Notify

Always Notify escalates every matching detection, even when automated triage would resolve or monitor it. It also takes precedence over repeat suppression. Exclusion rules still apply.