Routes send events matching a condition to a specific destination. Where a policy selects by keys/categories/severity, a route is a lightweight, condition-based rule — ideal for fan-out such as "everything with severity ≥ 4 also goes to the SIEM".
¶ What a route contains
- Name and Enabled flag.
- Conditions — one or more tests on a field. Each condition has:
- Field —
category,audit_key,severity,executable,pathorprimary_type. - Operator —
eq,ne,gte,lte,prefix,glob,regexorcontains. - Value — the value to compare against.
- Field —
- Destinations — where matching events are sent.
¶ How to use it
Click New route, describe the condition (for example field = severity, operator = gte, value = 4), select the destination and click Apply. Routes and policies are complementary: policies express your main selection intent, routes add targeted fan-out to extra destinations.