Summary
To configure scenario settings and rules in Sentinel, you need to define the scoring rules, threshold values, and search scope that determine when alerts are triggered. This article walks you through setting up individual scenario rules, configuring thresholds, and defining the message scope for your monitoring scenarios.
Prerequisites
Login credentials to MirrorWeb Insight
Admin access to Sentinel
At least one scenario category configured
Understanding of your organisation's compliance monitoring requirements
Step-by-Step Instructions
Step 1: Navigate to the scenario configuration page
From the Sentinel dashboard, click Scenarios in the navigation menu, then select the scenario you want to configure from the list.
Step 2: Access the scenario settings
Click the Settings tab to view the scenario configuration options. This displays the rules, threshold, and scope settings for the selected scenario.
Step 3: Configure scoring rules
In the Rules section, define the conditions that contribute to the scenario score. Click Add Rule to create a new rule, then:
Enter a descriptive name for the rule
Select the rule type from the dropdown (keyword match, sender pattern, etc.)
Set the score value (positive scores contribute to alerts, negative scores exclude messages)
Configure the specific conditions for the rule
Important: Negative scores act as exclusion rules. If a message matches a rule with a negative score, it will be excluded from triggering the scenario regardless of other rule matches.
Step 4: Set the alert threshold
In the Threshold section, enter the minimum score required to trigger an alert. The scenario will fire when the total score from all matching rules meets or exceeds this threshold.
Step 5: Define the message scope
Configure which messages the scenario monitors in the Scope section:
Select the Platforms to monitor (email, Teams, Slack, etc.)
Choose the Message Direction (inbound, outbound, or both)
Set Date Range parameters if needed
Add any Additional Filters such as sender domains or content types
Step 6: Test and save the configuration
Click Test Configuration to validate your rules against sample data, then click Save to apply the scenario settings.
Recording: Complete workflow showing navigation to scenario settings, adding multiple rules with different scores, setting threshold, configuring scope options, and saving the configuration
Notes
Note: Scenario rules are evaluated against messages that meet the scope criteria. Messages marked as import, marketing, deleted, or system messages are automatically excluded from Sentinel monitoring.
Important: Changes to scenario configuration only apply to future message processing. Existing alerts and scores are not recalculated when you modify rules or thresholds.
Note: Rule scores can be negative to create exclusion conditions. For example, a rule with a score of -100 will prevent any message matching that rule from triggering the scenario, regardless of other rule matches.