Skip to content

Learn · Guides

Write your first rule

Say what happens when a warning label is seen.

Checked against the product on · written for everyone

A rule has two halves. The first half names a warning label to watch for. The second half names one action from a fixed list. Everything the platform does on your behalf runs through a rule.

The fixed action list

Four groups, and every action belongs to one of them. A rule pack adds warning labels. The action list stays the same for every account.

Every action a rule can take.
GroupActionsWhat happens
Write it downRecordThe logbook gets an entry. This one is always on.
Tell a personNotify · Ask for review · EscalateA person is told, or a call is put in the review queue.
Gate the actionAllow · Challenge · Hold · BlockThe thing in flight is allowed, held, or stopped.
Fix itTurn off access · Switch off · Open a ticket · Call your systemYour systems are acted on through a bound connector.
Safe by default. When two rules fire on one event, the most careful action wins. A rule marked sensitive is held for a person, and the approval is written to the logbook with the approver on it.

Create the rule

console.dmzagent.com/rules/new

Respond

New rule

1
Name
Overheat hold
When this is seen
temperature-excursionA warning label from your rulebooks.
Do this
HoldFrom the fixed action list. A rulebook can never add an action.
Severity
High
Ask a person first
No
2When two rules fire on one event, the most careful action wins.
3CancelTest against past eventsCreate rule
Figure. The new-rule form. The action comes from the fixed list. The new-rule form: pick a warning label, pick an action from the fixed list, set severity and sign-off.

  1. Open Rules and select New rule, then fill in the name and the label.1

    The label list holds every warning label from your installed rule packs, plus any you wrote.

  2. Read the precedence line.2

    It states what happens when this rule and another fire together.

  3. Select Test against past events, then Create rule.3

    The test replays your stored events and reports how many times the rule would have fired. Nothing is dispatched.

Check it fired

console.dmzagent.com/rules

Respond

Rules

1All labelsOnNew rule
2
RuleWhen this is seenDo thisSign-offState
Overheat holdtemperature-excursionHoldNot neededOn
Escalate repeatrepeat-excursionEscalateNot neededOn
Cut accesscredential-exposureTurn off accessRequiredOn
Log onlylow-confidenceWrite it downNot neededOn
Figure. The rules list. Each row shows the label watched, the action taken, and whether sign-off is required. The rules list with four rules, the warning label each watches, the action each takes, and whether it is on.

  1. Return to Rules and confirm the state reads On.1

  2. Open Records and look for the entry that names your rule.2

    Every firing writes one entry.

Ask the assistant to wire this in →Open your organization