---
slug: /cse/rules
title: Cloud SIEM Rules
description: Learn about Cloud SIEM rules, including how to write rules, rules syntax, and Cloud SIEM built-in rules.
canonical: https://www.sumologic.com/help/docs/cse/rules/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

This guide has information about Cloud SIEM rules, including how to write rules, rules syntax, and Cloud SIEM built-in rules.

In this section, we'll introduce the following concepts:

<div className="box-wrapper" >
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/about-cse-rules')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>About Cloud SIEM Rules</h4></a>
  <p>Learn about Cloud SIEM rules, rules syntax, and how to write rules.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/rules-status')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Rules Status</h4></a>
  <p>Learn about Cloud SIEM rules statuses and how to address rules in a degraded or failed state.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/before-writing-custom-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Before You Write a Custom Rule</h4></a>
  <p>Learn how to plan a custom rule and prototype rule expressions.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/cse-rules-syntax')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Rules Syntax</h4></a>
  <p>Learn about the functions you can use when writing Cloud SIEM rules.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-match-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Match Rule</h4></a>
  <p>Learn how to write a match rule.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-chain-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Chain Rule</h4></a>
  <p>Learn how to write a chain rule.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-aggregation-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Aggregation Rule</h4></a>
  <p>Learn how to write an Aggregation rule.</p>
  </div>  
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-threshold-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Threshold Rule</h4></a>
  <p>Learn how to write a Threshold rule.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-first-seen-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>First Seen Rule</h4></a>
  <p>Learn how to write a First Seen rule.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/write-outlier-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Outlier Rule</h4></a>
  <p>Learn how to write an Outlier rule.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/cse-built-in-rules')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Built-In Rules</h4></a>
  <p>Look at the various page lists and Cloud SIEM's built-in rules.</p>
</div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/normalized-authentication-rules')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Normalized Authentication Rules</h4></a>
  <p>Detect activities that compromise accounts using authentication logs.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/normalized-threat-rules')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Normalized Threat Rules</h4></a>
  <p>Learn about Cloud SIEM’s built-in normalized threat rules.</p>
  </div>  
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/rule-tuning-expressions')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Rule Tuning</h4></a>
  <p>Learn how to create and use tuning expressions for rules.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/tailor-global-rule')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Tailor a Global Rule</h4></a>
  <p>Learn how to tailor global (built-in) rules in Cloud SIEM.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/rules/insight-trainer')}><img src={useBaseUrl('img/icons/operations/rules.png')} alt="Flow diagram icon" width="40"/><h4>Insight Trainer</h4></a>
  <p>Learn how to adjust rules to improve insight generation.</p>
  </div>
</div>
</div>