Rules

The Rule Catalog lists detection rules - built-in and custom - with rule metadata, status, scope, severity, type, and version information.

The scanner ships 75 built-in rules, 59 of them active by default. The other 16 are deliberately off; see Built-in rules for the complete catalog and the reasoning.

Working with the catalog

• Search by name, matching anywhere in the name.
• Filter by category, severity, and scope through autocomplete dropdowns over the values that actually exist.
• Enable or disable a rule directly in the list - no need to open it first.

Toggling a rule appends a new immutable rule version whose only change is the status, and is audited. For a built-in rule this has one consequence worth knowing: a toggled built-in stops picking up catalog updates automatically. See Rule versioning.

Rule detail

Each rule shows its regex and its context keywords, then the validators the rule version carries: Entropy with its minimum entropy, Length with its min and max length, Checksum, and Keyword proximity with its proximity window and proximity keywords, plus the positive and negative keyword lists. Below those sit the positive and negative examples and the full version history. Administrators can select an older version and roll back to it; a rollback creates a new current version and is audited.

Findings record the exact rule version that produced them, so an old finding stays explainable even after the rule has moved on.

Context keywords

A rule can carry positive and negative context keywords, recorded on the rule version next to its regex. They annotate a match; they never decide one:

• Only the regex decides what matches. Keywords never create a match and never remove one, and there is no confidence score anywhere in the product.
• The text around a match is searched, case-insensitively, as a plain substring - so account also matches accounts.
• They are evaluated only by the Test rule panel on the rule detail page, which labels a match positive keyword context match or negative keyword context match. A live scan does not evaluate them at all.

For example, a rule matching customer numbers like CUST-123456 with the positive keywords customer, account, invoice, run through the Test rule panel:

Text	Result
Please check customer CUST-123456 before invoicing.	Matches, labelled positive keyword context match - "customer" is nearby.
Screenshot placeholder CUST-123456 in the mockup.	Matches, no label - no keyword nearby.

Treat keywords as a reading aid while you shape a rule, not as a filter.

Test workbench and activation

Custom rules include a test workbench. Add positive and negative examples, run the test, and review the match outcomes. A custom rule must pass a test run before it can be activated - which is why a new custom rule starts inactive.

Built-in rules need no per-install test run; their regexes ship pre-validated and covered by tests.

Custom rules

Administrators can create custom regex rules for organization-specific patterns. The form asks for name, category, severity, scope, description, regex, and context keywords. Category and scope are autocomplete dropdowns, and category also accepts free text for a name of your own.

Custom rules can be moved between environments with Ruleset Transfer.