Default rules
Seven default rules are created the first time an owner opens the page: mass permission change, standard office hours, unknown actor, data export, large export, export velocity and access list change. Each is editable. Up to twenty rules per organisation.
Buttons and dialogs
| Control | What it does |
|---|---|
| Add ruleDialog | Choose a rule type, threshold, window, severity and whether it is enabled. Save rule stores it and it takes effect on the next scan. Add your first rule appears in the empty state. |
| EditDialog | Opens the same dialog titled Edit rule. A preview shows how many recent events would have matched. |
| DeleteDialog | Opens Delete this rule. Default rules can be deleted and later restored. |
| Restore default rulesDialog | Opens Restore the default rules. Resets the seven defaults to their shipped values, keeps any rules you added, and records anomaly_rule.restore_defaults in the audit log. |
| Save rulesButton | In the settings panel: saves office hours, timezone and deduplication window. |