A custom repository is a dedicated storage for an organization's detection content within a separate database integrated into SOC Prime Platform's cloud infrastructure (with an encrypted rule body at rest). Custom repositories provide SOC Prime Platform users with a secure environment to store and organize Content, either uploaded by users or copied from the SOC Prime Platform.
Content items stored in a custom repository can be grouped the same way as on Prime Core, with multiple translations of the same rule linked together.
Create and Manage a Custom Repository
To create or manage custom repositories, go to CI/CD in the upper-right corner and select Repositories.
My Repositories page lists all repositories available to you:
My – All custom repositories created by you (both shared and not shared to company)
Company – All custom repositories created by your team (including you)
You can view and manage your own repositories and shared repositories created by your teammates
You can see in the list the non-shared repositories created by your teammates but cannot access them
Create Custom Repository
Click Add Repository to create a new custom repository.
Give your repository a meaningful name.
Turn on the Share to Company toggle if you want to share the repository with other users from your company
Not shared repositories are visible and available only to you
Shared repositories are visible to your team and any team member can add/delete content or manage repository settings (except for the sharing setting)
If needed, provide a description of a repository.
Select the Data Planes you'd like to associate with this repository.
In the External Access section, turn on the Make available for Prime Detect toggle to allow synchronization with your organization’s Prime Detect instance. This section is visible only for the Prime Detect users. With this toggle turned on, content updates made in Prime Detect will be reflected in Prime Core, and updates in Prime Core will be synchronized to Prime Detect.
Click Apply.
Edit Custom Repository
To edit a custom repository, select the pencil icon on the repository record, make the needed changes in the modal, and select Save Changes.
Delete Custom Repository
To delete a custom repository, on the repository record, click the three-dot menu, select Delete, and confirm your action.
Bulk Translate
To translate the rules from the custom repository:
On the repository record, click the three-dot menu, select Bulk Translate.
In the modal, select the source language of the rules in the input panel and the target language for the translation in the output panel.
Select Translate.
The Translation Results modal summarizes the translation outcome, showing the percentage of content that was successfully translated, partially translated, or failed in translation. Select View all to view detailed information for translation statuses.
Export All Sigmas
You can export all Sigma rules from the custom repository to Prime Detect if access to Prime Detect is enabled for the organization.
On the repository record, click the three-dot menu, select Export All Sigmas.
Select Download File to download a ZIP archive containing the detection rules in YAML format. Use the password from the modal to access the files.
If the export file has been previously prepared and updates were made in the repository, click Regenerate File to include the latest changes. Then select Download File.
Note: It is possible to run only one export operation at a time.
You can find details about importing in the Prime Detect guide.
View Content in a Custom Repository
You can view the content stored in a custom repository by clicking the Open Content button on the repository record on the My Repositories page or via the Prime Core's Search.
For viewing the content in a custom repository from the Search page, first, use the switch under the search bar to toggle between Platform repositories and Custom repositories. By default, the Platform Repos option is selected. To see and search content from custom repositories, toggle the switch into the My Repos state.
By default, content from all custom repositories available to you is shown (both created by you and shared with you by your teammates). If you want to see and search content only from specific repositories, choose them in the selector and click Apply.
You can search for and filter content in custom repositories the same way as the content published on TDM (content from the Platform Repos). However, note that some filters such as Content Availability and Content Action State are not applicable to custom content. Additionally, filtering will work only as long as corresponding metadata is present in the custom content. To learn about the filtering options, follow this guide.
Add and Manage Content
You can add content to a custom repository in one of two ways:
Fork an existing content item from Prime Core.
Add content via Prime Architect.
To edit a content item stored in a custom repository, open it in Prime Architect.
Forking Content from Prime Core
You can copy any Sigma rule or its translation available to you in Prime Core to your custom repository. This action is referred to as forking.
Go to Prime Core's Search and select content items by setting checkmarks next to them.
Click Fork to My Repo.
You can also fork all detection rules from your search results across all pages. For this, select at least one checkbox next to a rule to reveal the Select All Items button, click it to select all rules, and then choose Fork to My Repo. Please note that selecting all detections is available only for the Fork to My Repo action.
This feature is available according to the users’ subscription plan.
In the modal, provide the following information:
Repository: Specify the repository to fork the rules to.
Translation: Specify which translations to fork.
Select Fork.
If the selection includes rules that are locked, the modal will display the number of available and locked rules. To fork only the rules that are available to you, select Fork Available Only. To include Premium rules, select Unlock & Fork All.
When you fork a content item, its metadata is also copied. When you fork a translation of a Sigma rule, the original Sigma rule is copied together with the translation.
Adding and Editing Content via Prime Architect
You can add content to your custom repositories in Prime Architect:
Save content created from scratch
Add a new translation to an existing rule
Update an existing translation
Open an existing translation and save it as a new rule
Save rule created from scratch
Go to Prime Architect > Translation and write/paste a rule/query in any of the supported languages.
Click Save As > New Rule in the panel with the content.
Fill in saving parameters:
Save to – Select the custom repository to save your content.
Platform – Ensure the platform name is correct.
Content Name – Give your content a name. In the case of a Sigma rule, this field is pre-filled with the Sigma title.
Some metadata fields are pre-filled with values from the original rule. Review these values and update them if needed, and optionally provide additional metadata in the remaining fields:
Description – Provide a description of your content.
Severity – Select the severity level from the dropdown.
Status – Select the status from the dropdown.
In the MITRE ATT&CK section, provide the following information:
Tactics – MITRE ATT&CK tactic names or IDs. You can check the full list of possible values here.
Techniques & Sub-Techniques – MITRE ATT&CK technique or sub-technique names or IDs. You can check the full list of possible values here.
TRAM Tags – MITRE ATT&CK techniques automatically inferred by SOC Prime's customized TRAM ML model.
Tools/Software – The names or IDs of the relevant tools or software. You can check the full list of possible values here.
Actors/Groups – The names or IDs of the relevant threat actors or groups. You can check the full list of possible values here.
Tags:
Log Sources – Provide log source category, product, or service in the Sigma rule or add a custom value. Custom values are saved and become available for selection across your organization.
Custom – Provide any custom value. Custom values are saved and become available for selection across your organization.
Audit Configuration – Provide audit configuration details:
Event Volume
Definition
Enable Commands
GPO Audit Policy
Additional Info:
False Positives – Enter information on possible false positives.
Triage Recommendations – Enter information on possible ways to validate and investigate suspected malicious activity.
Click Save > Save to save the content to your custom repository, or click Save > Save & Publish to save it to the repository and make it available to all SOC Prime users.
Note: In case of a Sigma rule, all available metadata is parsed and will be displayed on the Detection Intelligence tab of the Detection rule page. Yet, if you only save a query or rule in a different language, most metadata and intelligence fields will be empty.
Add a new translation to an existing rule
Go to the Search page and select a rule from the list.
On the Detection Code tab of a Detection Rule page, open a Sigma rule or a content item in another format using the Open in Prime Architect button.
In Prime Architect, generate/write a translation of the opened content and select Save As > Update to my Rule in the panel with the translation you want to add.
If the panel with the translation was on the right, it will move to the left and the saving settings will appear. Fill in saving parameters:
Note: You cannot change the custom repository for saving.
Platform – Ensure the platform name is correct.
Content Name – Give your content a name. In the case of a Sigma rule, this field is pre-filled with the Sigma title.
Some metadata fields are pre-filled with values from the original rule. Review these values and update them if needed, and optionally provide additional metadata in the remaining fields:
Description – Provide a description of your content.
Severity – Select the severity level from the dropdown.
Status – Select the status from the dropdown.
In the MITRE ATT&CK section, provide the following information:
Tactics – MITRE ATT&CK tactic names or IDs. You can check the full list of possible values here.
Techniques & Sub-Techniques – MITRE ATT&CK technique or sub-technique names or IDs. You can check the full list of possible values here.
TRAM Tags – MITRE ATT&CK techniques automatically inferred by SOC Prime's customized TRAM ML model.
Tools/Software – The names or IDs of the relevant tools or software. You can check the full list of possible values here.
Actors/Groups – The names or IDs of the relevant threat actors or groups. You can check the full list of possible values here.
Tags:
Log Sources – Provide log source category, product, or service in the Sigma rule or add a custom value. Custom values are saved and become available for selection across your organization.
Custom – Provide any custom value. Custom values are saved and become available for selection across your organization.
Audit Configuration – Provide audit configuration details:
Event Volume
Definition
Enable Commands
GPO Audit Policy
Additional Info:
False Positives – Enter information on possible false positives.
Triage Recommendations – Enter information on possible ways to validate and investigate suspected malicious activity.
Click Save > Save to save the translated content to your custom repository, or click Save > Save & Publish to save it to the repository and make it available to all SOC Prime users.
If you now want to update the current translation and save the updated version, select Save As > Update to my Rule and ensure that the current platform name is selected in the Platform field of the saving settings.
Update an existing translation
Open a translation from its page in Prime Core using the Open in Prime Architect button. Note that you can update only translations stored in your custom repositories, not those that are published in Prime Core.
In Prime Architect, update the translation code as needed and select Save As > Update to my Rule. Ensure that the current platform name is selected in the Platform field of the saving settings.
Fill in saving parameters:
Note: You cannot change the custom repository for saving.
Platform – Ensure the platform name is correct.
Content Name – Give your content a name. In the case of a Sigma rule, this field is pre-filled with the Sigma title.
Some metadata fields are pre-filled with values from the original rule. Review these values and update them if needed, and optionally provide additional metadata in the remaining fields:
Description – Provide a description of your content.
Severity – Select the severity level from the dropdown.
Status – Select the status from the dropdown.
In the MITRE ATT&CK section, provide the following information:
Tactics – MITRE ATT&CK tactic names or IDs. You can check the full list of possible values here.
Techniques & Sub-Techniques – MITRE ATT&CK technique or sub-technique names or IDs. You can check the full list of possible values here.
TRAM Tags – MITRE ATT&CK techniques automatically inferred by SOC Prime's customized TRAM ML model.
Tools/Software – The names or IDs of the relevant tools or software. You can check the full list of possible values here.
Actors/Groups – The names or IDs of the relevant threat actors or groups. You can check the full list of possible values here.
Tags:
Log Sources – Provide log source category, product, or service in the Sigma rule or add a custom value. Custom values are saved and become available for selection across your organization.
Custom – Provide any custom value. Custom values are saved and become available for selection across your organization.
Audit Configuration – Provide audit configuration details:
Event Volume
Definition
Enable Commands
GPO Audit Policy
Additional Info:
False Positives – Enter information on possible false positives.
Triage Recommendations – Enter information on possible ways to validate and investigate suspected malicious activity.
Click Save > Save to save the translated content to your custom repository, or click Save > Save & Publish to save it to the repository and make it available to all SOC Prime users.
Open an existing translation and save it as a new rule
Open a translation from its page in Prime Core using the Open in Prime Architect button. Note that you can update only translations stored in your custom repositories, not those that are published in Prime Core.
In Prime Architect, update the translation code as needed and select Save As > New Rule.
Fill in saving parameters:
Save to – Select the custom repository to save your content.
Platform – Ensure the platform name is correct.
Content Name – Give your content a name. In the case of a Sigma rule, this field is pre-filled with the Sigma title.
Some metadata fields are pre-filled with values from the original rule. Review these values and update them if needed, and optionally provide additional metadata in the remaining fields:
Description – Provide a description of your content.
Severity – Select the severity level from the dropdown.
Status – Select the status from the dropdown.
In the MITRE ATT&CK section, provide the following information:
Tactics – MITRE ATT&CK tactic names or IDs. You can check the full list of possible values here.
Techniques & Sub-Techniques – MITRE ATT&CK technique or sub-technique names or IDs. You can check the full list of possible values here.
TRAM Tags – MITRE ATT&CK techniques automatically inferred by SOC Prime's customized TRAM ML model.
Tools/Software – The names or IDs of the relevant tools or software. You can check the full list of possible values here.
Actors/Groups – The names or IDs of the relevant threat actors or groups. You can check the full list of possible values here.
Tags:
Log Sources – Provide log source category, product, or service in the Sigma rule or add a custom value. Custom values are saved and become available for selection across your organization.
Custom – Provide any custom value. Custom values are saved and become available for selection across your organization.
Audit Configuration – Provide audit configuration details:
Event Volume
Definition
Enable Commands
GPO Audit Policy
Additional Info:
False Positives – Enter information on possible false positives.
Triage Recommendations – Enter information on possible ways to validate and investigate suspected malicious activity.
Click Save > Save to save the translated content to your custom repository, or click Save > Save & Publish to save it to the repository and make it available to all SOC Prime users.
When you save a translation of a Sigma rule from a Platform repo, the original Sigma rule is copied together with the translation.
Deleting Content
You can delete any content item from custom repositories created by you and shared with you by your teammates.
Go to Prime Core's Search > My Repos and select content items by setting checkmarks next to them.
Click Delete.
Note: If you delete a custom repository from the My Repositories page, it will be permanently deleted together with all the content it holds.