Understand the Rules dashboard
Supported in:
To open the Rules dashboard in Google Security Operations, select Detections > Rules & Detections from the navigation bar, and make sure the Rules Dashboard tab is selected.
The Rules Dashboard tab lists your Google SecOps rules. If your system uses data Role-Based Access Control (RBAC), you see and manage only rules bound to accessible data scopes. For details, see data RBAC impact on Rules.
Rules dashboard overview
The top section of the Rules Dashboard tab features:
| Feature | Description |
|---|---|
| RULES CAPACITY | Shows your rule quota usage. Click to see details about:
|
| View Detections Health Dashboard | Open the Detections Health Dashboard to monitor rule performance, execution status, and the impact of rule replays and late-arriving data. This dashboard helps you troubleshoot detection delays and optimize rule efficiency. See Monitor rule performance. |
Rules table columns
The dashboard lists your rules with the following columns:
| Column | Description |
|---|---|
| TODAY | Number of detections generated by the rule today. |
| RULE NAME | Display name of the rule. Click the name to open the Rule Detections view. |
| PAST 4 WEEKS ACTIVITY | Sparkline chart showing detection trends for this rule over the past four weeks. Hover over a bar to see the exact detection count for that date. |
| LAST DETECTION | Timestamp of the most recent detection generated by this rule. |
| AUTHOR | User or entity that created or last modified the rule. |
| SCOPE | Data scope bound to the rule, which restricts accessible data based on RBAC. |
| SEVERITY | Severity level assigned to the rule (for example, High, Medium, or Low), as defined in its metadata. |
| ALERTING | Indicates whether the rule generates alerts in Google SecOps when detections occur. Can be toggled on or off. When enabled, detections escalate into alerts and trigger any configured notifications or SOAR playbooks. See Manage unified rules. |
| RETROHUNT | Run the rule against historical log data to find past occurrences of a threat. Click the status to view previous retrohunt jobs or run a new one. See Run a rule against historical data. |
| RULE TYPE | Structure of the rule logic:
|
| RULE SCHEDULE | Execution schedule for the rule. For live rules, execution can be near real-time or at set intervals (for example, Hourly or Daily). The schedule directly affects detection latency. See Schedule rule runs and Configure customized schedules for rules. |
| LIVE STATUS | Indicates whether the rule actively monitors incoming data. Can be toggled on (Enabled) or off (Disabled). Disabled rules don't generate new detections. See Apply a rule to live data. |
Search and filter rules
Use the Search rules field at the top of the Rules tab to filter and find specific rules:
| Search type | Description |
|---|---|
| Keyword search | Enter keywords to search across all rule text. |
| Structured search | Use field filters and operators to build precise queries. Supported fields include display_name, text, tags, rule_owner, live_mode_enabled, and alerting_enabled. |
For example, you can search for:
display_name:"My Rule"text:"malware"rule_owner:"google" AND tags:"TA0001"live_mode_enabled=true AND alerting_enabled=true
For a detailed explanation of the search syntax, supported fields, and operators, see Search the rules list.
Rule actions
Hover over a rule row and click Actions to access the following options:
| Action | Description |
|---|---|
| Live Rule | Toggle Enabled to continuously evaluate incoming log data and generate detections in real time, or toggle Disabled to stop rule execution. Depending on performance, the rule status might automatically change to Limited or Paused. See Apply a rule to live data. |
| Alerting | Toggle on to flag detections as Google SecOps alerts and trigger any configured notifications or SOAR playbooks. Toggle off to record detections without generating alerts. See Manage unified rules. |
| Rule schedule | Configure the execution frequency for multi-event rules. The schedule directly affects detection latency and determines how late-arriving data is processed. See Schedule rule runs and Configure customized schedules for rules. |
| YARA-L Retrohunt | Run the rule against historical log data over a specified time range to uncover potential threats that occurred before the rule was enabled. See Run a rule against historical data. |
| Edit Rule | Open the rule text and settings in the Rules Editor to make modifications. |
| View Rule Detections | Open the Rule Detections view to inspect detections generated by this rule, trend graphs, and underlying event details. |
| Archive | Hide the rule and its associated detections from the default dashboard view. Archiving preserves the rule data without deleting it; you can extract the rule at any time. See Manage unified rules. |
Dashboard refresh options
Click the Last refreshed time indicator above the table to control how frequently dashboard data updates:
| Option | Description |
|---|---|
| Refresh now | Immediately fetch the latest data for the dashboard. |
| AUTO REFRESH | Set an interval for the dashboard to automatically refresh:
|
Set an auto-refresh interval to ensure you view the most up-to-date rule statuses and detection metrics without manual intervention.
Customize table columns
To customize the Rules table display, click any column header to access these options:
| Option | Description |
|---|---|
| Reorder Columns | Drag column headers to change their display order. |
| Resize Columns | Drag the divider between column headers to adjust column width. |
| Sort Columns | Click a column header to sort table rows ascending or descending by that column. |
Need more help? Get answers from Community members and Google SecOps professionals.