Rules Engine
Every event is evaluated by the Rules Engine in real-time. Rules fire instantly — no polling, no delays.
Rule Anatomy
IF [condition] AND/OR [condition] THEN [action] + [action]
Available Conditions
| Field | Operators | Example |
|---|---|---|
action | equals, contains | action = "payment" |
severity | equals | severity = "error" |
ai_risk_score | >, <, = | score > 80 |
metadata.amount | >, <, = | amount > 10000 |
event_count_5min | > | count > 50 |
hour | <, > | hour < 8 |
day_of_week | equals | day = "saturday" |
Available Actions
| Action | Description |
|---|---|
block | Stops agent, returns blocked: true |
send_notification | Email + Slack alert |
create_incident | Opens incident in dashboard |
require_approval | Human-in-the-Loop pause |
pause_agent(N) | Pauses agent N minutes |
disable_agent | Disables until manual resume |
Backtest
Every rule shows: "X events would have matched in last 7 days" before saving. Test before deploying.