Duplicating a Compliance Rule

Overview

Compliance rules are locked after creation to preserve audit integrity. When you need to adjust a rule’s settings, targets, or sources, the recommended approach is to duplicate the rule and make your changes on the copy.

Duplicating a rule opens the creation wizard with all fields pre-populated from the original rule. You can modify any parameter before saving. The original rule remains unchanged, and the new rule is saved as an independent copy.

This guide walks you through the duplication process and explains how the new rule relates to the original.

Before You Begin

Before duplicating a compliance rule, make sure you have:

• At least one existing compliance rule in the selected organization
• Access to the Compliance Alerts dashboard

Step-by-Step Guide

Step 1: Start the Duplication

1. Navigate to Compliance Alerts from the Safeguard main menu
2. Click the Rules tab
3. Find the rule you want to duplicate
4. Click the ⋮ icon in the Actions column
5. Click Duplicate

What you’ll see:
The rule creation wizard opens with all three steps pre-populated from the original rule’s configuration.

Step 2: Review and Modify Settings

1. Review the pre-selected Product categories and individual settings
2. Add or remove settings as needed
3. Click Select and Continue to proceed

What you’ll see: All settings from the original rule are already selected. You can expand any Setting dropdown selector to adjust individual settings.

Step 3: Review and Modify Targets

1. Review the pre-selected target entities and selection methods
2. Add or remove targets, or change selection methods as needed
3. If Templates are selected, review the bound network selection toggle
4. Click Select and Continue to proceed

What you’ll see:
All target selections from the original rule are pre-populated, including specific devices, templates, networks, and bound network settings.

Step 4: Review and Modify the Source

1. Review the pre-selected source filter and administrator list
2. Change the filter type or adjust the administrator selection as needed
3. Click Select and Continue to proceed

Step 5: Update Name and Save

1. Review the pre-populated Rule Name - it defaults to the original name with “(copy)” appended
2. Edit the name to something descriptive that distinguishes it from the original
3. Review or update the Description
4. Review the full configuration summary
5. Click Create Rule to save

What you’ll see:
The rule name field shows the original name with “(copy)” added. If the original name is longer than 34 characters, it is truncated before “(copy)” is appended to stay within the 40-character limit.What you’ll see: After saving, a success notification appears. You are returned to the Rules tab where the new rule is listed with a status of Active.

Important: The duplicated rule is completely independent from the original. Changes to one rule do not affect the other. The new rule has its own creation date, alert history, and status.

Best Practices

For managing duplicated rules:

• Rename the duplicated rule clearly so you can distinguish it from the original (e.g., “HQ Security - Extended” vs. “HQ Security”)
• After confirming the new rule works as expected, pause or delete the original if it is no longer needed
• Use duplication as a way to create rule variations for different targets or sources while keeping the same settings

For making changes to existing monitoring:

• Duplicate the rule before deleting the original to ensure you always have a working rule in place
• Review the Preview Alert results on the duplicated rule to verify the new configuration produces the expected alerts

Common Questions

Q: Does the duplicated rule inherit the original rule’s alerts?
A: No. The duplicated rule starts with a clean alert history. Only alerts triggered after the new rule is created appear under it.

Q: Is the duplicated rule active immediately?
A: Yes. Duplicated rules are created with a status of Active, regardless of the original rule’s status. If you duplicated an inactive rule, the copy is still active by default.

Q: Can I duplicate a rule and keep the exact same name?
A: Yes. Duplicate rule names are allowed. However, using distinct names is strongly recommended to avoid confusion when managing multiple rules.

Q: What happens if the original rule references entities or administrators that have been deleted?
A: The duplication wizard displays automatically removes any deleted entities or administrators.

Q: Can I duplicate a rule to a different organization?
A: No. Duplication is scoped to the current organization. Rules can only be duplicated within the same organization.

Next Steps

Now that you’ve duplicated a rule, you might want to:

• Pause the original rule
  If the duplicate replaces the original, disable it to avoid redundant alerts.
  See Pausing and Activating Compliance Rules.
• Delete the original rule
  Remove it permanently if it is no longer needed.
  See Deleting a Compliance Rule.
• View the new rule’s configuration
  Confirm everything looks correct on the rule information page.
  See Viewing Rule Information.