Skip to content
bynhDocs
Log in

Route events with rules

Choose which events reach each connection, then narrow them by severity, scope, component, certificate and more.

3 min readUpdated

Every connection has two filters. Events decide what kind of thing it hears about. Rules decide which of those events go through: only high-severity reports, only incidents that affect checkout, only your SOC 2 certificate.

Events by module

GroupEventWhen it fires
Status pageMonitor downA monitor failed its checks.
Status pageMonitor back upA monitor that was down answers again.
Status pageIncident openedSomeone posted an incident on the status page.
Status pageIncident updatedA posted incident has a new update.
Status pageIncident resolvedAn incident was marked resolved.
Status pageMaintenance scheduled, started, finishedA maintenance window was planned, began or ended.
CertificatesCertificate expiring90, 30 and 7 days before a certificate ends.
CertificatesCertificate expiredA certificate passed its end date.
DisclosureNew reportA researcher sent a report to your disclosure program.
DisclosureResearcher repliedA researcher wrote back on a report.
DisclosureReport status changedA report moved to a new status.
Access and policiesAccess request waitingSomeone asked for a document behind your NDA.
Access and policiesPolicy publishedA new version of a policy went live.

Chat and webhooks can take every event. Issue trackers take reports and incidents, and on-call tools take the events that open or close an alert; see their guides for what each event does there.

Add a rule

  1. Step 1: Open the routing

    Open the connection in Settings › Integrations and choose Edit routing. The rule builder is titled Only send when.

  2. Step 2: Add conditions

    Choose Add a condition, pick what to filter on, how to compare and the values. Values for monitors, components, certificates, documents and policies come from your workspace.

  3. Step 3: Match all or any

    Choose All of these to need every condition, or Any of these to need one. Up to 20 conditions, each with up to 50 values.

  4. Step 4: Read it back

    In plain words says the rule as a sentence. Check it reads the way you mean, then save.

Filter onEvents that carry itCompare with
SeverityReportsis any of, is none of
Asset or scopeReportscontains, doesn’t contain, is any of, is none of
WeaknessReportscontains, doesn’t contain, is any of, is none of
MonitorMonitor down and back upis any of, is none of
ComponentMonitors, incidents, maintenanceis any of, is none of
ImpactIncidentsis any of, is none of
CertificateCertificatesis any of, is none of
FrameworkCertificatescontains, doesn’t contain, is any of, is none of
DocumentAccess requestsis any of, is none of
NDA versionAccess requestscontains, doesn’t contain, is any of, is none of
PolicyPolicy publishedis any of, is none of
  • A condition only applies to events that carry what it filters on. A severity condition never holds back a monitor event, and an event with no matching conditions is sent.
  • Text compares without case and ignores spaces at either end.
  • An incident can affect several components. is any of passes when any of them is picked; is none of passes when none are.
  • Leave the rules empty to send every event you picked.

Send to several places

Rules belong to a connection, so a route with two destinations is two connections with the same events and the same rule. Take this rule:

  1. Step 1: Set up Slack

    Connect Slack to #security and pick New report (add Researcher replied and Report status changed to follow it). Under Only send when, add Asset or scope contains api.acme.com and Severity is any of High, Critical, with All of these.

  2. Step 2: Set up Jira

    Connect Jira, keep Create an issue for every new report on, and add the same two conditions.

  3. Step 3: Check the log

    Reports that don’t match never reach either connection. The ones that do show in each connection’s delivery log.

Was this helpful?

Edit this page on GitHub