Once you have created policy rules, you can manage them from the Policy Rules page. Policy rules are organized into different categories:
- Active: Rules that are currently published and running for your application
- Draft: Rules that aren’t completed or haven’t been activated yet.
- Archived: Rules that were previously published, but are no longer running.
You can learn about each category below.
Prerequisites
To manage and make changes to policy rules, you must have at least an Admin role.
Active rules
All rules that Account Defender currently enforces are in the Active tab. You can manage a rule by selecting the more options menu next to it. From here, you can:
- Change rule status: Update the rule’s status.
- Pause rule: Keep the rule in the Active tab, but stop Account Defender from applying that rule’s conditions to activity until you reactivate it.
- Activate rule: Reactivate a paused rule.
- Archive rule: Move the rule to the Archived tab.
- Set rule priority: Change the rule’s priority. You can also drag and drop rules to update priority. See About rule priorities for more information.
- View/edit rule structure: Make revisions to the rule.
- Duplicate rule: Make a copy of the rule.
About rule priorities
Account Defender prioritizes active rules by order of priority, with rule number 1 being most important. This means that, when matching attacks to policy rules, Account Defender uses the following logic:
- Account Defender attempts to match attacks to the conditions in each policy rule one by one.
- When Account Defender finds the first policy rule with conditions that match, then Account Defender performs the actions related to that rule.
- Account Defender stops attempting to match attacks with any remaining policy rules.
This means that if you have two or more policy rules with matching conditions, then Account Defender prioritizes completing the action associated with the earlier rule, then stops considering the remaining rules. So, for example, say you have ordered your policy rules like this:
- Policy rule that Adds activity to the ATO Dashboard if the Attack type is account takeover and the risk score is over 95.
- Policy rule that Allows and exits the rule base if the Attack type is account takeover and the account age is less than 10 days old.
- Policy rule that Disables the account if the Attack type is account takeover and the risk score is over 50.
Say your application receives an account takeover attack on an account that’s five days old and has an 80 risk score. This activity doesn’t match the first policy rule, so Account Defender doesn’t enforce it. However, it does match the second policy rule, which allows the activity, because the attack is on an account that’s less than 10 days old. So, Account Defender allows that activity and stops considering all other rules. In other words, even though the activity matches the third policy rule, Account Defender will never disable the account because it already found a rule with matching conditions earlier.
Draft rules
All rules that you’re currently editing or aren’t yet active are in the Draft tab. You can manage a rule by selecting the more options menu next to it. From here, you can:
- Change rule status: Update the rule’s status.
- Activate rule: Move the rule to the Active tab and start enforcing the rule on your application’s activity. When you activate a rule, you also need to set a rule priority.
- Delete rule: Permanently delete the rule from your account.
- View/edit rule structure: Make revisions to the rule.
- Duplicate rule: Make a copy of the rule.
Archived rules
All rules that were previously active but have since been deactivated are in the Archive tab. You can manage a rule by selecting the more options menu next to it. From here, you can:
- Change rule status: Update the rule’s status.
- Activate rule: Move the rule to the Active tab and start enforcing the rule on your application’s activity. When you activate a rule, you also need to set a rule priority.
- Move to drafts: Move the rule to the Drafts tab.
- View/edit rule structure: Make revisions to the rule.
- Duplicate rule: Make a copy of the rule.
