Inspection Rules

Each inspection rule defines an event route - a set of conditions that determines which events the rule applies to. When the event route matches, AIDR evaluates the

Access Rules and Prompt Rules configured in that inspection rule.

When you create a policy, AIDR generates default inspection rules based on the policy type. These rules cover the standard event routes for each collector category.

You can delete, modify, or add inspection rules.

For example, a policy can include the following event routes:

Name	Identifier	Rule key (including policy identifier)	Source	Conditions
Input	input_rule	k_t_boundary_input_policy	Default	app.event_type == input
Output	output_rule	k_t_boundary_output_policy	Default	app.event_type == output
My Tool Input	my_tool_input	k_t_boundary_my_tool_input_xt3ol	Custom	app.event_type == tool_input and app.app_id == my-gateway

Conditions

Event route conditions determine which events the inspection rule applies to. To preview a rule's conditions, hover over a condition on the rule page.

To edit conditions, click the pencil icon next to the conditions.

The condition editor works like the access rule condition editor. You can create expressions based on request attributes, combine them with AND and OR logic, and group them into conditions.

note:

Event route conditions cannot reference the following attributes available in access rules:

• rules.matched - Rule matches are unavailable because AIDR evaluates conditions before executing access rules.
• prompt.detections - Detection results are unavailable because AIDR evaluates conditions before determining prompt rules.

Update the conditions in the editor and click Save.

Order of execution

AIDR evaluates inspection rules in the order they are displayed:

• The first rule whose event route conditions match applies its Access Rules and Prompt Rules.
• If no event route matches, AIDR doesn't analyze the request but still logs the event with a No_Policy tag.

Reorder inspection rules

Because inspection rules follow first-match-wins evaluation, rule order matters.

To reorder rules:

1. Click the list icon at the top of the inspection rules panel.
2. In Reorder Inspection Rules, drag and drop rules to change their order.
3. Click Save to confirm the new order.

Create inspection rule

1. On the policy details page, in the Inspection Rules tab, click the plus icon (+).
2. In New Inspection Rule, enter a Name.
3. Add one or more conditions.
4. Click Save to create the rule.

The new rule appears in the inspection rules list. Each rule contains its own Access Rules and Prompt Rules sections where you configure detection and response behavior.

Import rules

You can import access rules and prompt rules into an inspection rule from another policy.

1. Click the up-and-down-arrow import icon next to the event route conditions.
2. Select a source policy from the list.
3. Select an inspection rule whose rules you want to import.
4. In Replace inspection rules in "<rule-name>"?, click Replace.

Imported access rules and prompt rules appear in the destination inspection rule. The source policy rules remain unchanged.

View findings

1. Click the search icon next to the import icon.
2. Select an inspection rule from the list. The Findings page opens, filtered to events that matched the selected rule.

Copy rule key

1. Click the menu icon next to the search icon and select Copy Key to copy the rule's unique identifier.

This key corresponds to the aiguard_config.rule_key value in AIDR logs.

Delete inspection rule

Click the menu icon next to the search icon and select Delete.

caution:

Deleting an inspection rule removes all access rules and prompt rules configured within it. This action cannot be undone.

Report Only Mode

When you enable Report Only Mode for an inspection rule, AIDR evaluates access rules and prompt rules, logs the results, but doesn't enforce actions. In Report Only Mode, AIDR doesn't return policy evaluation results to the collector.

In Report Only Mode, you can test policies and collect data for analysis without affecting end users. You can enable this mode per inspection rule to enforce some rules while testing others.

Example API 200 response in Report Only Mode

{
  ...
  "status": "Success",
  "summary": "The payload has been accepted and will be processed asynchronously",
  "result": {}
}

Common use cases for Report Only Mode:

• Test new policies in production without user impact.
• Tune detection rules before enforcement.
• Collect baseline data for policy development.

note:

Falcon Endpoint policy inspection rules with app.event_type == output always run in Report Only Mode. Transformation and blocking actions aren't available for browser output.

How Report Only Mode works with existing rules

When you enable Report Only Mode, action labels and color indicators change to reflect reporting-only behavior:

• Block becomes Alert, and the color indicator changes from red to orange. AIDR logs the event, but the request proceeds. Users aren't notified or interrupted.
• The color indicator for Transform actions, such as Replacement, Mask, and Format Preserving Encryption, changes from purple to blue. Transformations apply only to logged content for analysis. Users see the original, unmodified values.

AIDR sets the Status field in logs to Reported in either case.

Interpreting findings

In Report Only Mode, logged content shows what the policy would have done if enforced, not what users experienced. Examine the Reported status to distinguish evaluated findings from enforced ones.