Skip to main content

Custom Rules

Custom Rules in Programmable Mitigation enable organizations to define specific, tailored responses to security threats based on their unique application requirements, business logic, and risk tolerance. This flexible system allows for precise control over automated mitigation actions.

Rule Structure and Components​

Trigger Conditions​

Define when mitigation actions should activate:

  • Threat Detection Events: Respond to specific types of detected threats
  • Traffic Patterns: Trigger based on unusual traffic volume or patterns
  • Application Events: React to application-specific events or errors
  • Time-Based Conditions: Implement rules that activate during specific time windows
  • Geo-Location Triggers: Activate based on geographic location of requests

Conditional Logic​

Implement complex decision-making logic:

  • Boolean Operators: Use AND, OR, NOT operators for complex conditions
  • Threshold Comparisons: Greater than, less than, equal to comparisons
  • Pattern Matching: Regular expressions and wildcard patterns
  • List Membership: Check against whitelists, blacklists, and dynamic lists
  • Historical Analysis: Compare current events against historical patterns

Action Definitions​

Specify what actions to take when conditions are met:

  • Immediate Actions: Instant responses like blocking or redirecting
  • Delayed Actions: Scheduled actions that execute after specified timeframes
  • Conditional Actions: Actions that depend on additional verification
  • Escalating Actions: Progressive responses that intensify over time

Rule Types and Templates​

Traffic Management Rules​

Control and direct traffic flow:

rule_name: "High Volume IP Block"
trigger:
  condition: "request_count > 1000 AND time_window = 60s"
  source: "single_ip"
action:
  type: "block_ip"
  duration: "30m"
  notify: true

Bot Detection Rules​

Identify and respond to automated threats:

rule_name: "Suspicious Bot Behavior"
trigger:
  condition: "no_javascript AND rapid_requests AND missing_headers"
action:
  type: "javascript_challenge"
  fallback: "captcha_challenge"
  escalation: "block_if_failed"

Application Protection Rules​

Protect specific application functionalities:

rule_name: "Login Brute Force Protection"
trigger:
  condition: "failed_logins > 5 AND endpoint = '/login'"
  scope: "per_ip"
action:
  type: "progressive_delay"
  initial_delay: "5s"
  max_delay: "300s"
  notify_admin: true

Geographic Access Rules​

Implement location-based controls:

rule_name: "Geo-Restriction"
trigger:
  condition: "country NOT IN ['US', 'CA', 'GB']"
  endpoint: "/admin/*"
action:
  type: "block_request"
  message: "Access restricted by location"
  log_level: "warning"

Advanced Rule Features​

Dynamic Thresholds​

Adaptive thresholds that adjust based on patterns:

  • Baseline Learning: Establish normal traffic patterns automatically
  • Seasonal Adjustments: Account for predictable traffic variations
  • Contextual Thresholds: Different limits for different user types or times
  • Machine Learning Integration: Use AI to optimize threshold values

Multi-Condition Rules​

Complex rules with multiple triggering conditions:

rule_name: "Advanced Threat Detection"
trigger:
  primary_condition: "threat_score > 70"
  secondary_conditions:
    - "unusual_user_agent"
    - "suspicious_payload_patterns"
    - "rapid_endpoint_scanning"
  logic: "primary_condition AND (any secondary_conditions)"
action:
  immediate: "rate_limit"
  escalation:
    - condition: "threat_score > 90"
      action: "block_ip"
    - condition: "repeated_violations"
      action: "extended_block"

Rule Chaining​

Sequential execution of related rules:

  • Dependency Rules: Rules that only execute after others complete
  • Progressive Escalation: Gradually increasing response severity
  • Conditional Chains: Different paths based on intermediate results
  • Parallel Execution: Multiple independent actions triggered simultaneously

Rule Management Interface​

Visual Rule Builder​

Intuitive interface for creating custom rules:

  • Drag-and-Drop Components: Build rules by combining visual elements
  • Condition Templates: Pre-built condition templates for common scenarios
  • Action Libraries: Comprehensive library of available mitigation actions
  • Real-Time Validation: Immediate feedback on rule syntax and logic

Code-Based Editor​

Advanced text-based rule creation:

  • YAML/JSON Support: Define rules in structured data formats
  • Syntax Highlighting: Clear visualization of rule structure
  • Auto-Completion: Intelligent suggestions for conditions and actions
  • Version Control: Track changes and maintain rule history

Rule Testing Framework​

Comprehensive testing capabilities:

  • Simulation Mode: Test rules against historical data
  • Dry Run Execution: Preview rule effects without implementing changes
  • A/B Testing: Compare different rule configurations
  • Performance Impact Analysis: Assess computational overhead of rules

Performance and Optimization​

Rule Optimization​

Ensure efficient rule execution:

  • Condition Ordering: Optimize condition evaluation order for performance
  • Caching Strategies: Cache frequently evaluated conditions
  • Parallel Processing: Execute independent conditions simultaneously
  • Resource Limits: Prevent rules from consuming excessive resources

Monitoring and Metrics​

Track rule performance and effectiveness:

  • Execution Metrics: Monitor rule trigger frequency and execution time
  • Effectiveness Analysis: Measure rule success in preventing threats
  • False Positive Tracking: Identify and address overly aggressive rules
  • Resource Utilization: Monitor computational resource consumption

Auto-Optimization​

Intelligent rule improvement:

  • Learning Algorithms: Automatically refine rule conditions based on results
  • Threshold Adjustment: Dynamically optimize trigger thresholds
  • Pattern Recognition: Identify opportunities for rule consolidation
  • Performance Tuning: Automatically optimize rule execution order

Integration and Extensibility​

External Data Sources​

Incorporate external information into rules:

  • Threat Intelligence Feeds: Use real-time threat data in rule conditions
  • Reputation Services: Integrate IP and domain reputation data
  • Application APIs: Query application state and user information
  • Third-Party Services: Connect to external security and analytics services

Custom Action Plugins​

Extend available actions through plugins:

  • Webhook Actions: Trigger external services via HTTP requests
  • Database Updates: Modify application databases based on rule triggers
  • Notification Systems: Send alerts through various communication channels
  • Custom Scripts: Execute custom code for specialized responses

API Integration​

Programmatic rule management:

  • RESTful API: Complete rule management through HTTP APIs
  • Bulk Operations: Import and export rule sets efficiently
  • Automated Deployment: Integrate with CI/CD pipelines for rule deployment
  • Real-Time Updates: Modify rules without service interruption

Custom Rules provide the flexibility and precision needed to implement organization-specific security policies while maintaining the automation and intelligence required for effective threat mitigation at scale.