Rules starter pack
One click creates the three notification rules every workspace wants on day one, no manual rule-engine learning curve.
Last updated Jun 1, 2026
What it is
A one-click path to a working notification setup. Pick a channel, click Create 3 rules, and the workspace has the three rules every security team wants on day one, without learning the trigger vocabulary or guessing at reasonable rate limits.
What it produces
Three rules pointed at the channel you choose:
| Rule | Rate limit | Why |
|---|---|---|
| AI verdict: exploitable | none | Bounded by operator-initiated AI runs: every fire is a real signal |
| New KEV CVE match | 10 / hr | A Tenable-grade scan finding 80 KEVs at once shouldn’t wake the whole team |
| New critical finding | 10 / hr | Same rationale: bursts get rate-limited so the team’s not paged into noise |
cert_expiring intentionally omitted: most teams have
ACME-managed certs (Let’s Encrypt) that auto-renew, so the noise
outweighs the signal. Add it manually if your fleet runs custom
PKI.
What to use it for
- New workspace: don’t stare at an empty Rules tab; get a working setup in one click.
- Adding a second channel later (e.g. a SecOps Slack alongside the founder’s email): pick the new channel, click Create 3 rules again: idempotent, existing rules are left alone.
Why it matters
A notification system with zero rules is the same as no notification system. The starter pack is the difference between “I’ll configure this later” and “I’m getting useful pings by Tuesday.”
Why it’s valuable
- Idempotent. Re-clicking on a channel that already has these rules is a no-op, no duplicates.
- Rate-limited by default. The 10/hr cap on KEV + critical finding is the difference between a useful Slack channel and a channel everyone mutes after week one.
- Skippable. The empty-state card has an “or build one manually” link for operators who prefer to start from scratch.
How to use it
- Admin → Notifications → Channels: add at least one notifier channel (Slack / email / webhook / SIEM).
- Admin → Notifications → Rules: the empty-state card now shows the starter pack with a channel select.
- Pick the channel, click Create 3 rules.
- Tune later: any of the three rules can be edited / disabled / deleted like any other rule.