Custom Models

Trigger Workbench alerts based on user-defined event filters.


This feature is not yet available in all regions.

The Custom Models tab of Detection Model Management lists your organization's custom detection models.

The following table outlines the actions available on the Custom Models tab.



Add a custom model

Click Add to create a custom model

Filter custom models

Use the Search field and drop-down lists to locate specific detection models

  • Severity: The user-defined severity level of the detection model

  • Status: The status of the detection model

  • Last updated: The period of time when the detection model was last updated

  • Search: Provides partial matching for the model ID, name, or filters

Enable or disable a model

Turn the toggle on or off to enable or disable the detection model

Edit a custom model

Click the edit icon () for the model


Changes to the name or description of a custom model are not reflected in Workbench alerts previously triggered by the model.

Delete custom models

Select the checkboxes for the models you want to delete and click Delete


Deleting a custom model does not delete the custom filter used by the model.

The following table outlines the information available on the Custom Models tab.



Model ID

The unique identifier of the model


The user-defined severity of the model

Model name

The user-defined name of the model


Click the model name to view more information about the custom model.

An information icon () next to the model name indicates that the model is not functioning properly because one or more filters have been disabled. To restore full functionality, edit the query in the event settings of the disabled filters.

For details on how to edit the query, see Creating a Custom Filter.


The custom filters that define the events the model uses to trigger alerts

Group by

The way the model groups multiple events into a single alert

Last updated

The date and time the model was last updated

Last updated by

The user who last updated the custom model


The status of the custom model