Policies decide which normalised events are forwarded and to which destinations. A policy is a positive selector: an event that matches an enabled policy is sent to that policy's destinations.
¶ What a policy contains
- Name — a human-readable label.
- Match mode —
any(the event matches if it satisfies at least one criterion) orall(it must satisfy every criterion). - Audit keys — match on the audit rule key that produced the event (e.g.
identity,privileged,logins). - Categories — match on the assigned category (e.g.
authentication,user_group_mgmt). - Minimum severity — forward only events at or above a severity threshold (0–5).
- Destinations — one or more destinations the matching events are sent to.
- Add tags — optional labels attached to forwarded events, handy for downstream SIEM filtering.
¶ Creating or editing a policy
Click New policy (or a policy's name) to open the editor. Fill in the criteria, pick the destinations and click Apply.
Think of policies as the "allow-list" of your forwarding pipeline: nothing is shipped unless a policy (or a route) selects it. Combine a broad policy with exclusions to remove the few noisy event types you do not want.