> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siftstack.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Detect deviations automatically using Rules

> Automatically flag anomalies in your telemetry without manual inspection.

After completing this topic, you can write a CEL-based Rule that flags conditions in your telemetry data. Sift evaluates the Rule against a Run when you generate a Report and flags any deviations automatically.

<Note>
  New to Detect and Review? Read the [Overview](/documentation/review/overview) to understand how Rules, Reports, Annotations, and Campaigns work together before proceeding.
</Note>

## When to use this workflow

Use this workflow when you want Sift to flag a specific condition in your telemetry data every time a Run is evaluated. For example, flagging when a channel exceeds a threshold, drops below a minimum, or a log message contains a known error string.

Rules are reusable. Once created, a Rule can be applied to any Run and included in Report Templates so your team does not need to reconfigure detection logic from scratch.

If your signal's acceptable range varies across tests rather than sitting at a fixed limit, use Family statistics as dynamic thresholds instead. See [Detect statistical deviations using Family Rules](/documentation/analyze/families/detect-deviations-from-a-historical-baseline).

## Before you begin

* You have at least one Asset and at least one Channel ingested into Sift. See [Channels](/documentation/reference/channels-reference) and [Assets](/documentation/ingest/stream/organize-streamed-data-into-assets-and-runs).
* Optional: You have an existing Run to use for previewing the Rule before saving it.

## Complete the workflow

This walkthrough uses a concrete example: flagging when a channel called `motor_temp` exceeds 120 degrees.

### Step 1: Create a new Rule

1. In **Sift**, the <Icon icon="code-simple" /> **Rules** tab.
2. Click **New Rule**.
3. In **Rule name**, enter a name. For example, `Motor temp over threshold`.
4. Optional: In **Rule description**, enter a description.
5. In **Asset name**, enter or select the Asset that contains the channel you want to monitor.
6. Optional: In **Asset tag name**, enter a tag name to apply this Rule to all Assets with that tag rather than a single Asset.

### Step 2: Select input Channels

In the **Input Channels** list, select the channel(s) your Rule expression will reference. For this example, select `motor_temp`.

Sift assigns each selected Channel a shorthand variable in selection order: the first Channel becomes `$1`, the second `$2`, and so on. You use these variables in the expression in the next step.

You can select both raw telemetry channels and [Calculated Channels](/documentation/transform/create-a-derived-signal).

### Step 3: Write the expression

In the **Expression** box, enter a CEL expression that evaluates to `true` when the condition you want to flag is met. Reference input Channels using their assigned shorthand variables.

For this example, `motor_temp` was selected first, so it is `$1`:

```
$1 > 120
```

When this expression evaluates to `true` during a Run, Sift creates an Annotation at that point in time.

Keep the expression focused on a single logical condition.

Expression resources:

* For syntax help, operators, and Sift's built-in functions, see [Expression syntax](/documentation/reference/expression-syntax).
* For reusable logic shared across Rules, see [User-Defined Functions](/documentation/transform/reuse-expression-logic).

### Step 4: Preview the Rule against a Run

Before saving, preview the Rule against existing telemetry to confirm it behaves as expected.

1. In **Rule preview**, click **Select Run**.
2. In the **Runs** table, select one or more Runs that contain the channel you are monitoring.
3. Click **Preview N Runs**.

   Sift evaluates the expression against the selected Runs and shows the Annotations that would be generated, without saving them.
4. Review the output to confirm the expression fires when and only when you expect it to.

### Step 5: Decide between Rules and Ad Hoc Rules

Before publishing, decide whether this Rule should be a standard Rule or an Ad Hoc Rule:

* **Rules** are visible in the Rules tab, can be edited and versioned over time, and are the right choice for ongoing telemetry monitoring.
* **Ad Hoc Rules** are created via the API for ad hoc or CI/CD use, are not visible in the UI, and cannot be edited after creation.

For most use cases, use a Rule. For CI/CD pipeline integration, see [Rules vs Ad Hoc Rules](/documentation/reference/rule-settings#rules-vs-ad-hoc-rules).

### Step 6: Save and publish the Rule

1. Click **Save**.
2. Optional: In **Version notes**, enter a note describing this version.
3. Click **Publish**.

Sift saves the Rule as version 1. Every subsequent edit creates a new immutable version, preserving the full change history.

## Verify the result

After publishing:

* The Rule appears in the **Rules** tab with the Asset and Channels you configured.
* You can click the Rule to view its expression, version history, and preview output.
* The Rule is now available to select when generating a Report or building a Report Template.

## Next steps

* To apply this Rule without manually selecting it each time, add it to a Report Template. See [Set up a repeatable review checklist](/documentation/review/set-up-a-repeatable-review-checklist).
* To review a Run using this Rule now, see [Detect and review issues in a Run](/documentation/review/detect-and-review-issues-in-a-run).
* To manage Rule versions or promote an older version to current, see the version history section on the Rule's detail page.
* To write a Rule that flags deviations from a historical baseline rather than a fixed value, see [Detect statistical deviations using Family Rules](/documentation/analyze/families/detect-deviations-from-a-historical-baseline).

## Reference

* [Expression syntax](/documentation/reference/expression-syntax)


## Related topics

- [Detect statistical deviations using Family Rules](/documentation/analyze/families/detect-deviations-from-a-historical-baseline.md)
- [Detect and review issues in a Run](/documentation/review/detect-and-review-issues-in-a-run.md)
- [Compare Runs visually against a Family baseline](/documentation/analyze/families/compare-runs-visually-against-a-family-baseline.md)