Skip to main content
Version: 25.09

Datasets

This article explains how to create and manage datasets on the Object Management > Datasets screen.

Adding a New Dataset​

  1. Click Add new dataset and select a predefined template, or click Proceed without template.
  2. On the Creating new dataset page, enter a Name and Description for the new dataset.
  3. Select a Sensitivity rating from the dropdown menu (Low is the default shown).
  4. Select the specific Applied policies you want to apply to this dataset.
  5. Define the dataset conditions (for example, click Add your first condition).
  6. Click Advanced settings to specify whether changes should apply to past events in addition to new events.
  7. Click Save advanced settings to save any changes.
  8. Adjust dataset conditions based on the metrics displayed in the Performance panel (to the right of the conditions, not fully shown in the screenshot).
  9. Click Save changes to save the dataset.
  10. Use the sort option in the Last Modified column to quickly find the dataset you recently created.

Editing and Managing Datasets​

The Datasets tab displays all the configured datasets that classify your data. On this tab, you can add, view, edit, duplicate, and delete datasets.

Editing a Dataset​

  1. Click the Actions menu of the dataset, select View and edit.
  2. Click Edit dataset. The Performance panel dynamically updates to show how your changes would affect event matching.
  3. Click the links for individual metrics (Events, Locations, Users, and Policies) to review the changes. Tags like "Added" or "Removed" are shown to indicate the changes.
  4. After reviewing your edits, click Save changes. The changes made to a dataset will take effect immediately on new events.

Dataset Actions​

  • View and edit: Opens the dataset page to display the current configuration and the performance details.
  • Duplicate: Creates a new dataset using the settings of the selected dataset.
  • Delete: Permanently removes the dataset so it no longer applies to new events.

Usage Recommendation​

Cyberhaven recommends that you enable updates to past events judiciously for specific datasets or policies when you want to:

  • Correct the classification of the data historically, or
  • Retroactively investigate past activity with updated policies.