> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention/dlp-policies-and-rules/rules.md).

# Rules

The rule defines **what the system is to detect and how it is to respond to a specific event**.

Each rule belongs to a DLP policy and can include:

* one trigger,
* configured actions (multiple),
* notifications (multiple).

A sample rule can detect the connection of a specific USB device, block an unauthorized operation, and send a notification to the administrator.

{% hint style="info" %}
The policy defines the scope of protection, while the rule defines the system's specific behavior within that scope.
{% endhint %}

### Where are the rules located?

Go to:

**Data Protection -> Rules -> Policies**

Rules are displayed within the policies to which they have been assigned.

To view the rules belonging to the selected policy, click its name.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FegV83p2fFHmFyfNUpCqZ%2Fimage.png?alt=media&amp;token=e77fa161-8d46-4aec-9280-42037c8b4622" alt="Rozwinięta polityka DLP w eAuditor Cloud z listą przypisanych do niej reguł." width="375"><figcaption><p><em>Expanding a policy displays all rules assigned to it.</em></p></figcaption></figure>

### What does a rule consist of?

Rule configuration is based on three basic elements:

| Element          | Meaning                                                               |
| ---------------- | --------------------------------------------------------------------- |
| **Trigger**      | Defines the event or condition that starts the rule                   |
| **Action**       | Defines the action performed when the conditions are met              |
| **Notification** | Defines whether and to whom information about the event is to be sent |

Example:

**Trigger:** the user connects a USB device that meets specified conditions.

**Action:** the system blocks the unauthorized operation.

**Notification:** the administrator receives information about the event.

{% hint style="info" %}
Not every rule has to block user activity. Depending on the configuration, it can also be used to monitor and log specific events.
{% endhint %}

### Adding a rule

You can create a new rule within an existing policy.

{% stepper %}
{% step %}

#### Expand the policy

In the **Policies** click the name of the policy to which you want to add a rule.

A list of the rules assigned to it will be displayed.
{% endstep %}

{% step %}

#### Add a rule

Click:

**+ Add rule**

A new rule configuration tab will open.

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FCBYyerBFoHf8VmOXJ8r0%2Fimage.png?alt=media&amp;token=d44c3fbf-4683-4170-a70a-ef983d03cffe" alt="Widok polityki DLP z przyciskiem Dodaj regułę umożliwiającym utworzenie nowej reguły." width="375"><figcaption><p><em>The new rule is created within the selected policy.</em></p></figcaption></figure></div>
{% endstep %}

{% step %}

#### Configure the rule

Specify the required rule elements, in particular:

* name,
* triggers,
* actions,
* notifications.
* risk level

The individual mechanisms are described in detail in the following sections of the documentation.
{% endstep %}

{% step %}

#### Save the rule

After completing the configuration, save the rule.

The name of the saved rule will be visible on its tab and within the policy to which it was assigned.
{% endstep %}

{% step %}

#### Update policies

After saving the rule, return to the policies view and click:

**Update policies**

This will allow the modified configuration to be delivered to the eAgents.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Saving a new rule in the console does not yet mean that computers are using its latest version. After completing the configuration, remember to use the option **Update policies**.
{% endhint %}

### Working with rule tabs

When creating or editing a rule, its configuration opens in a separate tab at the top of the view.

You can have several rule tabs open at the same time.

The tab name corresponds to the name of the rule currently being edited and may change after the changes are saved.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FCyI8Y8rnUVeOQZ8zuhck%2Fimage.png?alt=media&amp;token=dd2bf39d-a9dc-4a33-b82e-5f86f8a50e69" alt="Karty otwartych reguł DLP w eAuditor Cloud umożliwiające równoczesną pracę z kilkoma regułami." width="375"><figcaption><p><em>Tabs let you switch between the rules currently open.</em></p></figcaption></figure>

{% hint style="warning" %}
If you start creating a new rule, save the configuration before closing its tab. Unsaved work may be lost.
{% endhint %}

### Editing a rule

You can modify an existing rule without creating it from scratch.

{% stepper %}
{% step %}

#### Find the rule

Expand the policy containing the rule you want to change.
{% endstep %}

{% step %}

#### Open editing

Click the **edit** icon next to the selected rule.

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FAwQPKbrabZLZxBjeGtdE%2Fimage.png?alt=media&amp;token=0a20628b-b7eb-4008-8def-bc8ca313902b" alt="Ikona edycji reguły" width="374"><figcaption><p><em>Rule edit icon.</em></p></figcaption></figure></div>

The rule will open in a separate tab.
{% endstep %}

{% step %}

#### Change the configuration

Depending on your needs, you can change, among other things:

* the rule name,
* triggers,
* their parameters,
* actions,
* notifications.
  {% endstep %}

{% step %}

#### Save changes

After finishing editing, save the rule configuration.
{% endstep %}

{% step %}

#### Update policies

After changing the rule, click **Update policies**, so that the new configuration can be delivered to the eAgents.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Before changing an active rule, check the scope of the policy to which it belongs. The change may affect all devices and users covered by that policy.
{% endhint %}

### Copying a rule

If a similar configuration is to be used in another policy, you do not need to create the rule from scratch.

Function **Copy** creates a copy of an existing rule in the selected policy. The original rule remains in the current policy.

{% stepper %}
{% step %}

#### Select the rule

Expand the policy and find the rule you want to copy.
{% endstep %}

{% step %}

#### Open copy or move

Click the **Copy/Move** icon next to the selected rule.

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FFEBDRii1QS4lVzZxounG%2Fimage.png?alt=media&amp;token=6606d11e-67f2-4673-bcd8-2e606e077a9b" alt="Ikona Kopiuj/Przenieś" width="374"><figcaption><p><em>Copy/Move.</em></p></figcaption></figure></div>
{% endstep %}

{% step %}

#### Select the Copy option

In the window that opens, select:

**Copy**
{% endstep %}

{% step %}

#### Select the target policy

Select the policy to which the copy of the rule is to be added.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2Fu1fjcm8Xk3bU1HM6VBAn%2Fimage.png?alt=media&amp;token=46e8ef18-4b2c-449e-b449-3a5206451715" alt="Okno kopiowania lub przenoszenia reguły DLP z możliwością wyboru operacji i polityki docelowej." width="375"><figcaption><p><em>When copying a rule, you must specify the policy in which its copy is to be created.</em></p></figcaption></figure>
{% endstep %}

{% step %}

#### Save the operation

Confirm the copying.

The original rule will remain in the current policy, and its copy will be added to the specified policy.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
After copying, two independent rules are created. Later editing of one of them does not automatically change the other.
{% endhint %}

### Moving a rule

Function **Move** allows you to change the policy to which an existing rule belongs.

Unlike copying, no second rule is created - the existing configuration is removed from the current policy and assigned to the target policy.

{% stepper %}
{% step %}

#### Select the rule

Expand the policy containing the rule you want to move.
{% endstep %}

{% step %}

#### Open copy or move

Click the **Copy/Move**.

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FAwQPKbrabZLZxBjeGtdE%2Fimage.png?alt=media&amp;token=0a20628b-b7eb-4008-8def-bc8ca313902b" alt="Ikona edycji reguły" width="374"><figcaption><p><em>Rule edit icon.</em></p></figcaption></figure></div>
{% endstep %}

{% step %}

#### Select the Move option

In the window that opens, select:

**Move**

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FcwzFb3FrCKp9JudtyCTL%2Fimage.png?alt=media&amp;token=b3e54ee1-7729-4284-b57c-7a18b396f122" alt="Opcja przenieś." width="375"><figcaption><p><em>Move option.</em></p></figcaption></figure></div>
{% endstep %}

{% step %}

#### Select the target policy

Select the policy to which the rule is to be moved.
{% endstep %}

{% step %}

#### Confirm the operation

After confirmation, the rule will be removed from the current policy and assigned to the specified policy.
{% endstep %}

{% step %}

#### Update policies

After changing the assignment, use the option **Update policies**.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Moving a rule changes its scope of operation. Before performing the operation, check the assignments of the source and target policies, as they may cover different users or devices.
{% endhint %}

### Copying vs. moving

| Operation | What happens to the source rule?   | What is created in the target policy?       |
| --------- | ---------------------------------- | ------------------------------------------- |
| **Copy**  | Remains in the current policy      | New copy of the rule                        |
| **Move**  | Is removed from the current policy | The same rule is assigned to the new policy |

{% hint style="info" %}
If you want to use a similar configuration in two policies, use the option **Copy**. If the rule has been assigned to the wrong policy and is to apply only in another one, use the option **Move**.
{% endhint %}

### Deleting a rule

You can delete a rule that is no longer needed.

{% stepper %}
{% step %}

#### Find the rule

Expand the policy containing the rule intended for deletion.
{% endstep %}

{% step %}

#### Select Delete

Click the **deletion** icon next to the rule.

<div align="left"><figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FtHBaRHwVsw31Jx0VIoQ4%2Fimage.png?alt=media&amp;token=8ef003b1-d240-4312-af07-6b1a04f4966b" alt="Ikona usuwania." width="357"><figcaption><p><em>Deletion icon.</em></p></figcaption></figure></div>
{% endstep %}

{% step %}

#### Confirm the operation

Confirm rule deletion.

The operation is irreversible.
{% endstep %}

{% step %}

#### Update policies

After deleting the rule, use the option **Update policies**, so that the change can be delivered to the eAgents.
{% endstep %}
{% endstepper %}

{% hint style="danger" %}
Rule deletion becomes permanent only from the Archive view. If the configuration may still be needed, it can be restored.

![Archiwum reguł.](https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2Fepo68jTJ1FrKssE1TObZ%2Fimage.png?alt=media\&token=64f0ec89-9d42-4a3b-9164-6d694d39eecc)

\
Permanent deletion requires confirmation of the logged-in user's credentials.&#x20;
{% endhint %}

### When to use which operation?

If you want to:

* **change the behavior of an existing rule** - use **Edit**,
* **use a similar configuration in another policy** - use **Copy**,
* **change the policy to which the rule belongs** - use **Move**,
* **completely remove the configuration** - use **Delete**.

### Best practice

When you have a large number of rules, use names that indicate both the monitored event and the expected response.

Instead of:

`USB 1`

it is better to use:

`USB - unauthorized media blocked`

Instead of:

`WWW`

it is better to use:

`WWW - blocked prohibited categories`

This makes it possible to identify the purpose of the rule without opening its configuration.

{% hint style="info" %}
If you are creating a new rule based on an existing configuration, it is safer to copy it first and only then modify it. The original rule will remain unchanged.
{% endhint %}

### FAQ

<details>

<summary><strong>Can one rule belong to several policies at the same time?</strong></summary>

Not as a single shared rule. If the same configuration is to be used in another policy, you can use the **Copy**.

A copy of the rule will then be created in the target policy, and it can later be edited independently.

</details>

<details>

<summary><strong>What is the difference between copying and moving a rule?</strong></summary>

**Copying** leaves the original rule in the current policy and creates a copy of it in the target policy.

**Moving** removes the rule from the current policy and assigns it to another one.

</details>

<details>

<summary><strong>Will changing a copied rule also change its original?</strong></summary>

No. After copying, they are independent rules and can be configured separately.

</details>

<details>

<summary><strong>After editing a rule, does the change take effect on computers immediately?</strong></summary>

No. After saving the changes, use the option **Update policies**, so that the latest configuration can be delivered to the eAgents.

</details>

<details>

<summary><strong>Can a deleted rule be restored?</strong></summary>

YES. Rule deletion becomes permanent only from the **Archive**. If the configuration may still be needed, it can be restored.

</details>

<details>

<summary><strong>Where is the rule behavior configured?</strong></summary>

Rule behavior is defined using **triggers, actions, and notifications**.

Each of these elements is described in detail in the following sections of the documentation.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention/dlp-policies-and-rules/rules.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.