> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siftstack.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Step 4: Capture and detect an event in the data with a Rule

export const SiftIcon = ({className}) => <span className={`inline-flex items-center align-middle text-black dark:text-white ${className || ''}`}>
    <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Artwork" x="0px" y="0px" viewBox="0 0 1005.58 733.96" style={{
  enableBackground: "new 0 0 1005.58 733.96",
  width: "2em",
  height: "2em"
}} xmlSpace="preserve">
      <path fill="currentColor" d="M552.16,150.89c-165.6,0-180.29,160.61-300.62,192.32v2.67h601.24v-2.67C747.74,324.18,717.72,150.89,552.16,150.89z   M453.46,583.08c165.6,0,180.29-160.61,300.62-192.32v-2.67H152.84v2.67C257.88,409.78,287.91,583.08,453.46,583.08z" />
    </svg>
  </span>;

## Overview

Now that you have explored the dataset and visualized key signals, this step shows you how to formalize your observation by creating a [Rule](/documentation/reference/rule-settings).

In Sift, Rules are reusable logic expressions that automatically detect patterns or thresholds in telemetry data. When you notice an unusual behavior such as a sudden temperature drop, you can turn that insight into a Rule so that future data is automatically monitored for similar conditions.

In the dataset, we can see a sharp and sudden decline in both **max\_air\_temp(C)** and **max\_ground\_temp(C)**. The image below shows that on October 6, 2021, at 17:00:00, both signals dropped well below their normal range. This event may reflect an unexpected environmental condition, like a cold front, or possibly a brief telemetry issue. By capturing this behavior in a Rule, you ensure that future datasets are automatically checked for similar anomalies and brought to your attention for review.

## Create a Rule

To monitor this anomaly in future data, we will define it as a Rule that Sift can automatically detect and highlight during ongoing telemetry analysis.

1. In **Sift**, click <SiftIcon className="icon-sift" />.

2. Click the <Icon icon="code-simple" /> **Rules** tab.

3. Click **New Rule**.

4. In the **Rule name** box, enter the following:
   ```
   fl_low_max_temp_anomaly
   ```

5. Replace `fl` with your own initials.

6. In the **Asset name**, select your Asset (for example, **fl\_mars\_env\_monitoring\_station**).

7. In the **Input Channels** list, select the following Channels:
   * **max\_air\_temp(C)**
   * **max\_ground\_temp(C)**

8. In the **Enter an expression** box, enter:
   ```
   $1 < -50 && $2 < -60
   ```

9. Click **Save**.
