Configure detections
Turn shipped detections on, tune organization settings, or define a new metric, probe, script, or event detection.
Before you start
- Confirm that the required metric, probe, script, or event source is available.
- Use an MFA-verified administrator session before changing a definition or organization settings.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Find the signal you intend to monitor
Open Detections. Search by name or key, then filter by kind, origin, or state. Turn on Show detections waiting on a collector or connector before concluding that a shipped definition is missing.
What you should see: You have identified the exact definition, its origin, current state, and readiness.
Inspect a shipped or organization definition
Open the row. Read its kind, source, condition, platforms, evidence fields, default severity, and linked organization settings. Shipped definitions are read-only; clone one when your organization needs a distinct definition.
Create the correct detection kind
Choose New detection, then select Metric, Probe check, or Script check. Give the definition a stable lowercase key, a clear name, and the condition required by that kind. Save the definition before configuring organization settings.
| Field or control | What to do |
|---|---|
| Metric | Compares a stored metric path with a threshold. |
| Probe check | Runs an allowed diagnostic probe and evaluates its structured result. |
| Script check | Uses an eligible check script on the selected platforms. |
Set organization behavior
Configure the default variant for this organization: enabled state, threshold or interval, severity, routing, and automatic resolution where supported. Review any source-readiness notice before enabling.
What you should see: The organization has one current settings record for the detection key and variant.
Test on the intended device
Use the available device test for the definition. Read the returned source values and evidence before treating a present or clear result as representative of the fleet.
Connect the detection to a governed response
Use the linked rule count to inspect an existing rule or create one. A detection decides when a condition is present. The rule separately defines scope, scripts or ticketing, guardrails, verification, and notification.
What you should see: The enabled detection and any response rule remain independently reviewable.
If something doesn’t work
A shipped detection is hidden.
Enable Show detections waiting on a collector or connector and clear the search and state filters.
The editor refuses to save.
Check the key, required source fields, selected platforms, condition, and current MFA verification. Reload if the organization or session changed.
Present is zero or unavailable.
Confirm the definition is enabled and its source is current. Zero present records is not proof that every device was evaluated.