Monitoring rules

Build withCopy prompt

Monitoring rules decide how each event is scored and which decision it earns. You configure them in the dashboard under Compliance → Monitoring rules — no code deploy, and changes apply to every event scored afterward in that environment.

Viewing the configuration is open to anyone with Compliance access; editing requires the monitoring:manage permission. Until you save once, an environment runs on the built-in defaults; saving creates an explicit configuration for that environment. Reset to defaults reverts the form to the platform defaults.

How scoring works

Build withCopy prompt

1. Every rule inspects the event and produces a signal from 0 (no risk) to 1 (maximum).
2. Signals are combined by weight using a soft-OR: any one strong signal can push the score high, and additional signals raise it further with diminishing returns.
3. The result is a composite score, 0–1 (surfaced as 0–100 on events).
4. The score is compared to two cutoffs to produce the decision.

        ALLOW            REVIEW              BLOCK
  ├──────────────┼──────────────────┼──────────────────┤
  0        review threshold    block threshold        1

Decisions & limits

Build withCopy prompt

The first tab, Decisions & limits, sets the cutoffs and money ceilings.

Decision thresholds

The review threshold must be less than or equal to the block threshold.

Metered billing (toggle) charges a small per-event fee for scoring in production only — sandbox and development are always free.

Money limits

Amount ceilings are held in a base currency (e.g. USD) with optional per-currency overrides. For each event, the engine picks the ceiling for that event's currency, falling back to the base currency when there's no override.

Add a currency to give it its own limits; remove it to fall back to base. Some behavioral rules also take per-currency minimum amounts (New-beneficiary, Round-amount).

Built-in rules

Build withCopy prompt

Every rule carries a weight (0–1) — how strongly it influences the composite score. 0 turns the rule off; 1 gives it full influence. The rules are grouped into three tabs.

Core rules

Threshold-based checks that work from amount / currency / country / counterparty alone.

Flow & velocity

Behavioral patterns across a sequence of events. These need specific data fields and stay dormant until you send them.

More signals

Match your payload to your rules. A behavioral rule with a weight but without the fields it needs never fires. The rule-coverage panel flags rules that are weighted but unconfigured. See the event data payload.

Custom rules

Build withCopy prompt

When the built-ins don't cover a scenario, author your own — declaratively, no code. Each custom rule has:

You can define up to 50 custom rules per environment.

Conditions

A condition is a tree combining field predicates with all (AND), any (OR), and not. The dashboard offers a Builder for flat all/any predicates and an Advanced (JSON) mode for arbitrary nesting.

Fields you can test: amount, type, currency, country, counterparty, direction, channel, ip, entity.riskTier, entity.nationality, and any custom meta_data.* path.

Operators: gt (>), gte (≥), lt (<), lte (≤), eq (=), neq (≠), in (in list), nin (not in list), contains, exists.

{
  "all": [
    { "field": "amount", "op": "gt", "value": 50000 },
    { "field": "currency", "op": "in", "value": ["BTC", "ETH"] }
  ]
}

The rule above — named high_value_crypto, score 0.8, weight 0.6 — flags large crypto transfers and contributes to the same composite score as the built-ins. An empty condition never fires, so the editor warns you to add at least one predicate.

Next steps

Build withCopy prompt

• Event monitoring — send events these rules score.
• Alerts, cases & SARs — investigate what the rules flag.