Detection Rules Explained

A detection rule watches for a pattern of events — a Threshold Count of matching events within a Window of minutes — and automatically fires one or more Response Actions when that pattern is hit: log it only, temporarily auto-block the IP, lock the account, force a logout, and/or email admins.

Rules can optionally be scoped to business hours, so the same pattern can be treated differently inside vs. outside your organization's normal working hours.

How rules connect to the access log

A rule doesn't operate in isolation — when it fires, its action shows up as its own event in System Access Logs (e.g. a rule with Auto-Block IP produces a Temp Block Expired-tracked entry later, and any rule change itself is logged as Detection Rule Change). Reading the log and tuning rules are two views of the same feedback loop — see How to Review System Access Logs

An Auto-Block IP response creates the same kind of temporary block you'd create by hand on Access Blocks — see Access Blocks Explained — the rule is just automating that action instead of you doing it manually after spotting something in the log.