Skip to main content
A Rule defines logical conditions used to automatically evaluate telemetry data from one or more Channels during a Run. Built using the Common Expression Language (CEL), Rules can identify behaviors, anomalies, or thresholds in live or historical data streams.

​
Capabilities

Rules can be created, previewed, and managed either through the Sift UI or programmatically using the Sift API. The following table describes the key capabilities of Rules:

​
Rules vs Ad Hoc Rules

All Rules in Sift share the same CEL-based evaluation engine and structure. However, the way a Rule is created determines how it is managed, who can see it, and how it integrates into your workflow.

​
Comparison

The following table compares Rules and Ad Hoc Rules:

​
When to use Rules

Use Rules for detection logic that:
  • Will be reused across multiple Runs.
  • Needs to be updated, versioned, or reviewed over time.
  • Should be visible and managed by your team in the Sift UI.
  • Will be included in a Report Template for standardized reviews.
Rules are the right default for most use cases.

​
When to use Ad Hoc Rules

Use Ad Hoc Rules when:
  • You are running automated evaluations in a CI/CD pipeline.
  • The Rule is ad hoc and does not need to persist in the UI.
  • You are generating Annotations programmatically via the API.

​
API reference

The following table lists the API endpoints for working with Ad Hoc Rules. The API uses the term isExternal for legacy reasons. This maps to Ad Hoc Rules in the Sift UI.

​
Batch request atomicity

Batch[Verb]Rules requests (for example, BatchUpdateRules, BatchArchiveRules) are atomic: if any Rule in the request fails, Sift does not apply the request to any Rule in that batch.

​
Live Rules

Live Rules evaluate expressions against telemetry data as it streams into Sift in real time. They are continuously evaluated as data is received from Assets and can also be re-evaluated on historical data when a specific Run is selected.
Live Rule evaluation is not enabled by default. To evaluate a Rule in real time, turn on Enable Live Rule Evaluation on the Rule. Without it, the Rule only evaluates when you run a Report. Programmatically, this corresponds to the is_live_evaluation_enabled field on BatchUpdateRules.

​
Live Rules and Reports

Live Rules that do not generate any Annotations during the original evaluation are not linked to the Report and will not be included if the Report is rerun. To evaluate a Live Rule that was missed, generate a new Report on the Run and select the Rule manually.

​
Rule evaluation state scoping

A Live Rule keeps separate evaluation state for data sent with a Run ID and data sent without one. Data sent without a Run ID is only ever compared against other data sent without a Run ID. These two evaluation states stay isolated: comparisons for data without a Run ID never include data associated with a Run, and a Run’s evaluation never includes data sent without one. If no data without a Run ID arrives for one hour, Sift drops that evaluation state. The next data point without a Run ID starts a new comparison instead of comparing against the earlier value. Because of this scoping, a Rule evaluated at the Asset level only evaluates data sent without a Run ID. It can’t evaluate data that’s associated with a Run — if a telemetry stream moves in and out of Runs, an Asset-level Rule only evaluates the portions sent without a Run ID.
If your telemetry stream moves in and out of Runs, resend the current value without a Run ID right after a Run ends to keep the no-Run evaluation state current.