Policy engine

Response → Policy engine (/response-management/rules) holds response rules: conditions over your endpoint and network events, and the actions to take when they match.

Rules

The Rules tab lists each rule with its priority, whether it is enabled, whether it needs approval, its sensor, hits, when it last fired and its time window. Per rule: Edit, Duplicate, Backtest, Delete.

• New rule opens the editor in guided mode, or advanced mode (JSONLogic conditions).
• An AI copilot can draft conditions and actions from a description. It never saves; you review and save.
• Backtest runs a rule against past events before you enable it.
• Run evaluator now evaluates rules immediately instead of waiting for the next cycle.
• Templates has starting points.

Actions

Family	Actions
Block	Block or unblock an IP at AWS Network Firewall, AWS WAF, or Cloudflare
Suppress	Mute or unmute a signature, a signature range, a group or an IP; de-duplicate a signature
Notify	E-mail (needs SMTP)

Blocking on endpoints and Cloudflare's "Under Attack" mode are not available as actions. Protected IPs are never blocked.

Approval

A rule can require approval. Its actions then wait in Pending approvals until someone approves or rejects them (one by one or in bulk, with a reason).

Audit

The Audit log tab records every action with its outcome: SUCCESS, NOOP (nothing to do, or a protected address), FAILURE, PARTIAL, PENDING_APPROVAL, APPROVED, REJECTED, UNSUPPORTED, QUEUED. For sensor mutes it shows whether the change is live on the sensor or a reload is pending.