DocsICP FilingConsole
Documentation
Home Page AgentLoop User Guide AI Agent Audit Custom audit rules

Custom audit rules

Updated at:
Copy as MD
Product
My Favorites

Custom audit rules supplement the risk determination criteria specific to your enterprise. You can describe the behaviors to detect or the risks to correlate to the Loopie chat assistant. The system then generates rules, execution tasks, and validation evidence, which you can review before you save and apply them.

Overview

Custom audit rules include two types of rules:

Rule type

Purpose

Output

Behavior detection rule

Identifies behaviors that meet specified conditions from raw Agent events

Detection findings

Event correlation rule

Correlates, filters, or makes supplementary determinations on detection findings

Risk events

The two types of rules are positioned in the detection pipeline as follows: audit data source -> behavior detection rule -> detection finding -> event correlation rule -> risk event.

To include a new custom detection pipeline in the Risk events view of the Overview and Risk Explorer, first create a behavior detection rule, and then create an event correlation rule that references the risk type or risk subtype output by the behavior detection rule. The system generates risk events based on detection findings only after the event correlation rule takes effect.

If you create only a behavior detection rule, its output serves only as an intermediate detection result. You can view it in Risk Explorer > Detection findings, but it does not appear in the Overview or in the Risk events view of Risk Explorer.

The two types of rules are linked by risk type and risk subtype. An event correlation rule can reuse the system-predefined behavior detection results, or process the output of custom behavior detection rules. The system-predefined detection capabilities are still managed in the detection configuration of Audit Management.

Prerequisites

  • An AgentSpace is created, and audit data ingestion is complete.

  • The current AgentSpace is bound to an available Simple Log Service (SLS) resource.

  • The current account has management permissions on the AgentSpace.

Go to the rule management page

  1. Go to AgentLoop console > Audit > Audit Management.

  2. In the Detection Configuration card at the top of the page, find Custom Rules.

  3. Click Manage Rules.

The Audit Management page also displays the total number of custom rules, the number of enabled rules, and the number of rules with runtime errors, so that you can quickly determine whether action is required.

View rule relationships

The rule management page uses event correlation rules as the main view by default:

  1. Select an event correlation rule on the left.

  2. On the right, view the complete processing pipeline: "Input risks → Correlation conditions → Output risk event".

  3. View the custom behavior detection rules that match the input risk scope of the current rule.

Behavior detection rules are listed separately at the bottom of the page, with two views: Unreferenced and All. "Unreferenced" means that no event correlation rule currently uses the risk type or risk subtype output by the rule. It does not mean that the rule itself is invalid.

Create a rule

  1. In the upper-right corner of the Custom Audit Rules page, click Create Rule.

  2. In the Loopie chat area, describe the risk to detect, the applicable scope, and the expected output. For example: "Detect reverse shell behavior in Agent tool calls."

  3. Wait for Loopie to complete sampling and validation and to generate the rules and tasks.

  4. In the review area on the left, view the overview, rules, and associated categories, and confirm the validation results in Validation and Evidence.

  5. Click Review and Save and check the detection rules, associated categories, and execution tasks to be saved.

  6. After you confirm, save and apply the current version.

After the save is complete, the task may still be being applied. Return to the rule list and refer to the running status displayed on the page.

Manage existing rules

Operation

Description

View details

View the rule summary, running status, switch, associated categories, and implementation information.

Enable or disable

Toggle the switch of the task to which the rule belongs. If multiple rules share the same task, the page indicates the impact scope of the operation.

Edit name and summary

Modify the display name and description of the rule.

Modify detection with Loopie

Adjust the detection logic through conversation, revalidate it, and save a new version.

Delete

If the task contains only the current rule, you can delete it directly after confirmation. If the task contains multiple rules, Loopie must first generate a complete task with the current rule removed.
Important

Deleted rules cannot be restored. After the deletion takes effect, the rule no longer produces new detection results. Detection findings and risk events that have already been generated are not deleted. Confirm the impact scope before you delete a rule.

View the type catalog

Switch to Type Catalog at the top of the page to view, by hierarchy, the predefined and custom risk categories, risk subtypes, and entity types available in the current AgentSpace. You can use the type catalog to confirm whether the categories referenced by rules exist, and to view their definition IDs, sources, and versions.

Verify rule results

  1. Return to Risk Audit > Risk Explorer.

  2. To view event correlation results, select Risk events. To view behavior detection results, select Detection findings.

  3. Filter by risk type, risk subtype, or detection identifier.

  4. Open the risk details, and use the Session context and evidence to determine whether the rule works as expected.

Results of a newly saved rule appear in Risk Explorer only after the corresponding task is applied and produces data.

Previous：Audit ManagementNext：Risk Audit