Detection Rules

Sentinel Nerd uses a YAML-based rule engine to detect threats, anomalies, and policy violations across your UniFi ecosystem in real-time.

Rule Structure

Every detection rule is a YAML document with the following structure:

name: namespace.rule_name
    description: Human-readable description of what this rule detects
    severity: critical | high | medium | low | info
    enabled: true
    source: unifi_network | unifi_protect | unifi_access | unifi_talk | any
    tags:
      - network
      - brute_force
    conditions:
      - field: event.type
        equals: login_failure
      - field: event.src_ip
        not_in: [192.168.0.0/16, 10.0.0.0/8]
    window: 5m
    threshold:
      count: 5
      group_by: event.src_ip
    actions:
      - alert:
          channels: [email, slack]
      - enrich:
          threat_intel: true

Fields Reference

Metadata Fields

Condition Operators

Conditions evaluate fields from incoming events. Available operators:

Windowing and Thresholds

For aggregate detections (e.g., brute force), use window and threshold:

name: net.ssh_brute_force
    description: Multiple SSH login failures from a single source
    severity: high
    source: unifi_network
    conditions:
      - field: event.type
        equals: login_failure
      - field: event.dst_port
        equals: 22
    window: 5m
    threshold:
      count: 10
      group_by: event.src_ip
    actions:
      - alert:
          channels: [slack, email]
      - active_response:
          action: block_ip
          duration: 1h

Actions

When a rule matches, one or more actions execute:

• alert — Send notifications via configured channels (Alerting docs)
• enrich — Run threat intelligence lookups on matched events
• active_response — Execute automated response (Active Response docs) Pro
• tag — Add tags to matched events for later analysis
• snapshot — Save a camera snapshot (Protect events only)

Built-in Rule Packs

Sentinel Nerd ships with curated rule packs that you can enable with one click:

• Network Security (12 rules) — Brute force, port scans, unauthorized access
• IDS/IPS Correlation (8 rules) — Enhanced Suricata alert triage
• Physical Security (10 rules) — Access control and camera monitoring
• Anomaly Detection (6 rules) — Traffic and behavior anomalies Pro
• Compliance (8 rules) — PCI-DSS, SOC 2 monitoring rules Enterprise

Managing Rules via API

Rules can be managed programmatically via the Rules API. This is useful for deploying rules from version control or automating rule management across multiple instances.