Skip to main content
Groups organize your users and endpoints so you can control how Wirespeed applies automation to those assets. Create and edit groups under Settings > Groups.

​
How Groups Work

If an asset belongs to any group that has a setting disabled, that automation is disabled for the asset — even if other groups the asset belongs to have it enabled.
Always Notify is opt-in per group. If an asset belongs to any group with Always Notify enabled, the override applies to that detection. Exclusion rules still take precedence and will close matching detections without notifying the client.

​
System Groups

Wirespeed seeds a set of built-in groups that are automatically maintained. System groups are indicated by the Wirespeed logo and cannot be deleted.

​
User Groups

​
Endpoint Groups

​
Custom Groups

Create your own groups to match your organization’s structure. Each custom group has:
  • Name — a short label displayed throughout the platform
  • Description — optional context for your team
  • Color — visual identifier shown on badges
  • Chat Ops — enable or disable chat ops for the group
  • Containment — enable or disable containment for the group
  • Always Notify — always escalate to notify the client (see table above)
  • Source systems updated - Sync detection changes related to these assets back to your detection platforms.
Custom groups can be deleted when no longer needed.

​
Group Rules

Rules automatically assign assets to groups based on field matching. This keeps group membership up to date as your directory syncs without any manual work.

​
Rule Properties

​
Matchable Fields

User fields: Endpoint fields:

​
Pattern Types

Text — used by custom rules. Use * as a wildcard. For example:
  • ceo@* matches any email starting with ceo@
  • *admin* matches any value containing admin
  • *@example.com matches any email at that domain
Regex — used exclusively by Wirespeed-managed system rules for advanced matching. Custom rules cannot use regex patterns.
System rules (indicated by the Wirespeed logo) cannot be deleted, but they can be disabled. Custom rules can be deleted or disabled at any time.

​
When Rules Run

Rules are evaluated automatically after each directory or endpoint sync. When an asset matches a rule, it is added to the corresponding group. If a rule is later disabled or the asset no longer matches, the assignment is removed — unless a user has manually overridden the membership.

​
Viewing Group Membership

When viewing a user or endpoint detail page, their assigned groups are displayed as badges. Hover over any group badge to see which rule matched the asset to that group.

​
Manual Overrides

You can manually add or remove assets from groups on the individual user or endpoint detail pages. Manual assignments take priority over rule-based assignments:
  • Manually adding an asset to a group persists even if no rule matches it.
  • Manually removing an asset from a group persists even if a rule would otherwise assign it.

​
Groups and Directory Sync

Group membership is synced during directory and endpoint sync operations. Until the initial sync completes, automation decisions that depend on group membership (like containment) are deferred to avoid acting on incomplete data.