Skip to content

Deploying detection rules

After you write or update a detection rule in the Library, you still need to enable it for your tenant. Enabling tells LogMan.io which rules should run in production. Until a rule is enabled, it stays in the Library but does not process live events.

This page explains how to enable rules from the Detections screen, what the status badges and metrics mean, and how deployment relates to writing rules in the Library.

Who can do this?

You need permission to open the Detections screen (lmio:detection:access). To check boxes and click Enable, you also need lmio:detection:edit. To open a rule in the Library, you need asab:library:access.

Where to work

Place What you do there
Library Create, edit, and test detection rules (YAML files)
Detections Choose which rules are enabled for the tenant
Discover Investigate events and triggers for a specific rule

The Detections screen is titled Overview of detections and correlations. Open it from the main menu (eyeglasses icon). The tree shows rules from two Library areas:

  • Correlations — correlation rules (window, match, sigma, and similar types)
  • Detections — detection rules in the broader detections tree

Rules that are not enabled appear in the tree but do not show the green enabled badge.

Enable rules step by step

1. Review the rule tree

When the screen loads, LogMan.io shows:

  • All rules and folders from the Library
  • Which rules are currently enabled (green badge)
  • Live metrics for the last hour (when available)

Disabled Library items appear grayed out. You cannot enable a rule that is disabled in the Library until an administrator or editor re-enables the file there.

2. Select what to run

Use the checkboxes in the tree:

  • One rule — check the row for a single YAML file
  • A folder — check the folder to select all rule files inside it (subfolders included)
  • Clear a selection — uncheck the rule or folder

The checkbox tooltip says Check to deploy.

Folders vs single rules

You can enable an entire folder when all rules inside should run, or pick individual files when you only need part of a folder. The top level roots Correlations and Detections do not have checkboxes. You always select folders or files below them.

Special folders: Rules under Detections → Parsec and Detections → Filters are managed differently. They always show as enabled in the tree and cannot be toggled from this screen.

3. Click Enable

Click the Enable button in the top right corner.

LogMan.io saves your full selection for the tenant. The message The detection rules were successfully deployed confirms the change. The tree reloads and enabled rules show the green badge.

Enable replaces the full list

Enable always saves the complete set of checked rules. If you uncheck a rule and click Enable again, that rule is removed from production. There is no separate Disable button.

4. Confirm in Discover (optional)

For an enabled rule, click the metrics area on its row to open Discover filtered to that rule (last hour). This helps you verify that triggers or predicate hits look reasonable after deployment.

Understanding status and metrics

Enabled badge

A green enabled pill on a row means that rule path is part of the tenant deployment. If you enabled a folder, each file under it that is included in the selection shows the badge.

Metrics on each row

Metrics refresh about every 60 seconds. They describe the last hour unless you change the time range elsewhere.

Label Meaning
Trigger In (bell) How many times the rule reached its trigger stage
Predicate Hit (arrow) How many events matched the rule predicate
Total time Processing time spent on the rule (all phases)
P / E / A / T Time in Predicate, Evaluate, Analyze, or Trigger (window rules)

On folder rows, numbers are aggregated from all child rules. Folder rows do not link to Discover.

A highlighted letter under P / E / A / T shows which phase uses the most time. If Total time is high, see Monitoring detection performance for tuning guidance.

Typical workflows

Turn on a new rule you wrote

  1. Save and test the rule in the Library
  2. Open Detections
  3. Find the rule file and check its checkbox (or check the parent folder)
  4. Click Enable
  5. Wait for metrics to appear, then open Discover from the rule row if needed

Turn off a rule without deleting it

  1. Open Detections
  2. Uncheck the rule (or uncheck its folder if you enabled the whole folder)
  3. Click Enable

The rule file remains in the Library. It simply stops running on live events.

Enable many rules at once

  1. Check a folder (for example a vendor or use case folder under Correlations)
  2. Review that all files under it should run
  3. Click Enable

Your administrator may set limits on how many rules run per correlator instance. Very large folders are split automatically on the platform side. You do not configure that from the UI.

Edit a rule that is already enabled

  1. Open the rule from the Detections tree (name links to Library)
  2. Edit and test in the Library
  3. Save the file

If the rule stays checked on the Detections screen, it continues to run with the updated content after the platform reloads correlators. You do not need to click Enable again unless you changed which rules are selected.

How this fits together

flowchart LR
    LIB[Library: write and test rules]
    DET[Detections: select and Enable]
    RUN[Correlators run enabled rules]
    DIS[Discover: investigate events]

    LIB --> DET
    DET --> RUN
    RUN --> DIS

Behind the scenes, LogMan.io Tenant Rex stores your selection, updates correlator configuration, and restarts correlator services on the cluster. You do not manage servers from the Detections screen.

Permissions and troubleshooting

Problem What to check
Detections menu is missing Ask for lmio:detection:access
Checkboxes are disabled Ask for lmio:detection:edit
Cannot open rule name Ask for asab:library:access
Rule enabled but no metrics Wait one refresh cycle (~60 s); confirm events match logsource
Rule enabled but no triggers in Discover Predicate may be too strict; check event lane and time range
Grayed out rule in tree File is disabled in the Library