Write and publish a rule

Build a rule, check what it would have matched, publish it to your machines, and read the matches it records.

Rules live under Policies › Rules. Editing and publishing rules needs the Admin or Owner role.

Before you start, read How policies work: rules start in shadow mode and only record until the workspace is armed.

1. Open the rule builder

   On Policies › Rules, press Edit Rules. Choose where to start: What’s active now copies the rules your machines currently hold; Blank starts from nothing.

   Sentinel can open the same builder pre-filled from a proposal. An incident’s Response card has Draft a shadow rule, which opens Policies › Rules with nothing pre-filled. The builder’s own Publish is the only thing that saves, whichever way you arrived.

2. Add a rule

   Press Add a rule. A rule is one disposition over conditions:

   • The disposition is what the rule wants when it matches: record, ask or refuse.
   • The conditions say what the rule is about, across up to six kinds of condition. Every kind you fill in must match. Within one kind, any one value is enough.

   Keep each rule about one thing. Two narrow rules read better in Matches than one broad rule.

3. Check rules

   Press Check rules. The builder validates the set and reports problems before anything is published.

4. Publish

   Press Publish…. A review opens showing what these rules would have matched recently. Nothing is saved until you confirm there. On confirmation the set gets a new serial and your machines pick it up.

   Publishing an empty set removes every rule your machines currently hold. The builder says so: “Add at least one rule — publishing an empty set removes every rule your machines currently hold.”

5. Read the matches

   Policies › Matches lists every time a rule noticed an action, with facets by Decision and By rule. The header chart shows Rule matches over time by day. In the page’s words: “A match means a rule noticed the action — it does not mean the action was wrong, or that it was interrupted. One action can match several rules.”

   Every label says what the rule would have done (“would have refused”, “would have asked”, “recorded”), never what happened, because in shadow mode nothing is interrupted.

​

Why didn’t my rule match?

Check	Where
Did the action happen in the window you are looking at?	Matches, time range
Did every condition kind you filled in match? All kinds are required together; only values within one kind are alternatives	The rule, in Edit Rules
Is the serial your machines hold the one you published?	Policies header, Serving now and Fleet
Did the action reach Quint at all?	Live Activity; if empty, Verify and troubleshoot
What would the rule have done against real traffic?	Shadow enforcement

​

Next

• Shadow enforcement: read what your rules would have done, and what arming means.
• Alerts: where a refused action is sent, and a scheduled summary of what your rules matched to Slack, Teams or a webhook.