> For the complete documentation index, see [llms.txt](https://docs.autopilotmonitor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autopilotmonitor.com/rules/analyze-rules.md). # Analyze Rules Analyze rules are the analysis engine of Autopilot Monitor. Every enrollment session is automatically evaluated against all enabled rules — no one has to watch the dashboard for problems to surface. A rule that matches produces a **finding** on the session: * a **severity** (info / warning / high / critical) and a **confidence score**, * an **explanation** of what was detected, with the actual evidence from this session interpolated in (app names, error codes, durations), * **remediation steps** that tell you what to do about it, * optionally, links to related documentation. Findings appear as cards on the session detail page and feed the analysis summary, fleet statistics, and per-rule telemetry (how often each rule fires across your enrollments). ## In this section


Concepts	The anatomy of a rule: conditions, sources, operators, preconditions, and confidence scoring.	/pages/pZM01iruECxg53KbSyht
Built-in Rules Reference	The catalog of all built-in rules — what each detects and when it fires.	/pages/q2JHSbSc9j8eTSCOUldE
Template Rules	Configurable blueprints: fill in your environment-specific values and get a tailored rule.	/pages/Bfbg9b1wkeuFT1NKlRxx
Cookbook	Seven worked recipes for building your own rules, from five-minute template to end-to-end custom detection.	/pages/nqLYWWkvuTSZ85rrWv7E

## Managing rules in the portal The **Analyze Rules** page (requires the Admin or Operator role; editing requires Admin) shows all rules with search, severity/category filters, and type filters (Built-in / Community / Custom). Each rule card offers: * **Enable/disable** per tenant — your choice is preserved across product updates. * **Mark session as failed** — a per-rule toggle that makes a firing rule fail the whole session (a "knock-out criterion"). A few built-ins ship with this on by default; you can override it. * **Fire statistics** — how often the rule fired and its hit rate over the last 30 days, so you can see which rules actually earn their keep in your environment. * **Edit / Export** — custom rules are fully editable in a form or as raw JSON (the **Form ⇄ JSON** toggle); built-ins are read-only but can be exported as JSON to use as a starting point for your own. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.autopilotmonitor.com/rules/analyze-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.