Vai al contenuto
Docs

Rule reference

Rules turn change events into alerts. This is every field, operator and structure a rule can use, and what each one means.

Questo documento è pubblicato solo in inglese. Una traduzione dovrebbe essere una traduzione legale, e preferiamo mostrarle il testo che vincola piuttosto che una sua approssimazione.

A rule evaluates against a single change event enriched with its path context, not against the graph as a whole. That keeps evaluation cheap, incremental and explainable — when an alert fires you can be shown the one event that caused it and the one condition that matched.

Condition fields

Every matchable field is a code, never a display string. A rule written in Danish and the same rule written in German store identical values and evaluate identically, which is only possible because the stored value is infrastructure rather than "infrastruktur".

Field
Type
Example
change.type
enum
entity_added
entity.id
reference
a named provider
entity.country
enum
ISO country code, such as US
entity.region
enum
EU, EEA, US, non_adequate
entity.category
enum
infrastructure, ai_ml, analytics
entity.parent_country
enum
for ownership-shift rules
path.depth
integer
shortest path from the watched root
vendor.id
reference
scopes a rule to one watched vendor
entity.name is deliberately absent. Matching on a name string breaks across languages and across renamings, and a company that renames itself would silently stop matching a rule that had been protecting you for a year. Match on entity.id.
US counts as adequate for every US company. The EU adequacy decision for the United States covers only organisations certified under the Data Privacy Framework — a fact about each company, not about the country. The graph does not yet track certification per company, so adequate takes the optimistic reading for the US. Match on entity.country if you need the strict one.

Change types

Type
What it means
entity_added
A discloser has started disclosing this entity as a subprocessor.
entity_removed
A discloser has stopped disclosing it.
jurisdiction_shift
The entity's processing country changed.
category_shift
The entity's category changed, such as analytics becoming AI and machine learning.
ownership_shift
The entity's parent company changed, which can move its effective jurisdiction with no change to any published list.
terms_shift
The disclosed terms of an existing relationship changed — the data types shared, the transfer mechanism, or whether the subprocessor is always in use. Wording-only edits are suppressed.
prospective_entity_added
An addition announced with a future effective date. Alerting on the announcement rather than the enactment is the only way advance notice is usable.
prospective_entity_removed
A removal announced with a future effective date.

Operators

equals, not_equals, in, not_in, contains, greater_than, less_than. Use in and not_in for sets of countries, regions or categories, and the comparison operators for path.depth.

Structure

Nested AND, OR and NOT groups over leaf conditions. Two levels of nesting covers every rule in the template library, and deeper nesting usually means two rules with different severities rather than one complicated rule.

Worked example

No new processing outside the EEA, anywhere beneath the vendors you have marked critical.

IF   change.type = entity_added
AND  entity.region NOT IN [EU, EEA]
AND  vendor.id IN [critical vendor set]
THEN severity = critical
     channels = [email, slack]
     delivery = immediate

Second example

Anything that appears at depth 1 under any vendor, at low severity, digested daily. Depth 1 is where a change is most likely to be contractually noticeable, and the volume is low enough to read.

IF   change.type IN [entity_added, entity_removed]
AND  path.depth = 1
THEN severity = informational
     channels = [email]
     delivery = daily digest

Rule output

Severity, notification channels and immediate-or-digest are attached to the rule rather than set globally. A critical jurisdiction rule can page you while a depth-1 inventory rule collects into a daily mail, and both can be true of the same account.

Dry run before you save

Every rule can be run against your current graph before it is saved, and you should. Without it you write a rule, see nothing for three days, and cannot tell whether it is correct and quiet or wrong and silent.

Scope

A rule applies account-wide or to one watched vendor. Tag-scoped rules are not built yet.

Inizi da un fornitore. Gratis, senza carta.

Cerchi un'azienda, la segua e veda la catena sotto di essa. Passi a un piano superiore quando un solo fornitore non basta più.