Learn · Services
Rules
Say what to do when something is wrong.
Checked against the product on · written for everyone
A rule pairs a when with a then. The when is a warning label from your installed rule packs. The then comes from one fixed list of actions, the same in every authoring surface.
console.dmzagent.com/rules
Respond
Rules
1All labelsOnNew rule
2
| Rule | When this is seen | Do this | Sign-off | State |
|---|---|---|---|---|
| Overheat hold | temperature-excursion | Hold | Not needed | On |
| Escalate repeat | repeat-excursion | Escalate | Not needed | On |
| Cut access | credential-exposure | Turn off access | Required | On |
| Log only | low-confidence | Write it down | Not needed | On |
The fixed action list
| Group | Actions | Reaches your systems |
|---|---|---|
| Write it down | Record | No. Always on. |
| Tell a person | Notify · Ask for review · Escalate | No. |
| Gate the action | Allow · Challenge · Hold · Block | The thing in flight only. |
| Fix it | Turn off access · Switch off · Open a ticket · Call your system | Yes, through a bound connector. |
Safe by default. A rule pack adds warning labels. The action list stays the same for every account, so installing a pack can never grant an action your account did not already have.
Build-up rules
A build-up rule handles a weak signal that keeps coming back. Each repeat steps the response up, and older events fade on a half-life. One odd reading stays quiet; a pattern gets attention.
| Standing | Means | A guard check answers |
|---|---|---|
| Allowed | Nothing has built up. | allow |
| Take a look | Signals are accumulating. | take a look |
| Held | The threshold was crossed. | block |
When two rules fire
The most careful action wins. A rule that blocks beats one that notifies, and a sensitive action is held for a person whatever else fired.