We would like to define the UEBA policies for the group of users matching to the File count.

Example, if the User group “A” has the threshold of deleting 5 files as a count & User group “B” has the threshold of deleting 10 files as a count.

We have identified the Predefined UEBA policy “Bulk Delete”. however, we can’t use it for the different user group with different file count.

Could it be possible to add template or the clone the predefined policies for the custom configuration?

 If we have use the UEBA custom policy, file count is not available which has activity as a condition.