Rules

A rule watches one event and notifies one or more channels when it fires.

Add a rule

Alerts > Configuration > Add rule.

To change which event a rule watches, create a new rule and delete the old one.

A spike event adds the multiplier and the floor to the dialog:

The 16 events

The events are grouped by the surface they watch:

"New" events fire the first time something is observed. Because reports are kept for 90 days, something that goes quiet for a quarter and returns is treated as new again.

The two Technologies events read the Technologies inventory rather than raw reports, so they need a plan that includes it. Refer to Tune a technology rule.

Cooldown

Cooldown is the minimum gap between notifications for a rule, entered in minutes and defaulting to 15.

It does not drop anything. Findings during the cooldown are batched into the next notification, so a burst produces one grouped message rather than 50.

Set it against how you consume alerts. 15 minutes suits a chat channel. For a rule that pages someone, set a longer cooldown. The maximum is 24 hours. A value above 1,440 minutes is rejected.

Tune a spike rule

Spike rules compare the last completed hour against the average of the previous 24 hours. Two settings control them, and both matter.

Spike multiplier is how many times the trailing average the hour must reach. Default 3, range 1.5 to 100.

Minimum reports per hour is a floor. Below it the rule stays quiet no matter the ratio. Default 50, range 1 to 1,000,000.

Leaving both at their defaults stores no configuration at all, so the rule follows any future change to the defaults. Setting them explicitly pins your values.

Wait until you know a site's normal volume before adding spike rules. Created on day one, the 24-hour baseline is still forming and the rule fires on the ramp-up.

Tune a technology rule

The two Technologies events watch the library inventory built from hash reports. Both fire on a change to the inventory, never on what was already there when the rule was created, so review the current inventory first. Refer to Get started with Technologies.

New vulnerability fires when an advisory is published for a library version already on the site, and when a version with a known vulnerability is detected for the first time. The one setting is Minimum severity: findings below it stay quiet. The default is Medium. Set it to High or Critical for a channel that pages someone, and leave it at Medium for a chat channel. Low includes advisories with a Low band; advisories with no severity assigned never fire.

The notification names the library and version and lists the CVE IDs, so the reader can go straight to the advisory.

Outdated or deprecated version fires when a technology is detected with, or moves to, one of the selected statuses. Two switches, Outdated and Deprecated, are both on by default and at least one must stay on. A Deprecated-only rule is the low-noise option: it fires rarely and each finding calls for a replacement rather than an upgrade.

Both rules batch like every other rule, so a deployment that brings in several outdated libraries produces one grouped message after the cooldown.

A rule set that works

For most sites, four rules:

Add spike rules after a couple of weeks, once the numbers mean something.

Rule state and deletion

The Enabled switch stops a rule without losing its configuration. Useful during a migration that will generate noise you already understand.

Deleting a rule discards anything pending for it.

Next steps

• Channels
• Delivery history
• PCI DSS
• Technologies