Analytic Rules

An Analytic Rule runs a query over your data and turns each row the query returns into a detection. Detections are then delivered to one or more destinations, either written to a Feed as XML or sent to people by email.

A rule is the combination of four things, each of which has its own tab on the rule.

• The query that decides what counts as a detection.
• The processing type, which decides when and how the query is run.
• The execution settings, which for a scheduled rule decide when it runs and over what period.
• The notifications, which decide where detections are delivered.

If you want to run a query on a schedule and send the results to someone as a file rather than as detections, use a Report instead. Reports and Analytic Rules share most of their configuration, so much of this section applies to both.

Processing Types

The Processing Type is set on the rule’s Execution tab and decides how the query is run. It is the most significant choice you make about a rule, because it determines what the rest of the rule’s configuration means.

Changing the processing type changes which tabs the rule shows, because some settings only apply to one type.

Scheduled Query

A Scheduled Query rule runs its query on a schedule, for example every hour or at 03:00 each day. Each run covers a window of data, and the rule keeps track of which windows it has already covered so that it can work through history without gaps or repeats.

This is the type to use for most rules. It is also the only type available to Reports.

Streaming

A Streaming rule is run by a Processor filter , in the same way as a translation pipeline. Each stream that matches the filter is passed through the rule as it is processed, so detections are raised without waiting for a schedule to come round.

Table Builder

Table Builder is an experimental feature and should not be used.

Anatomy of a Rule

The tabs shown on an Analytic Rule depend on its processing type.

The content of the Documentation tab is not just for readers. It is also used as the detailedDescription of the detections the rule raises, so it is worth writing something that will make sense to whoever receives the detection. This can be turned off per rule with Include Rule Documentation on the Settings tab.

Jobs

Analytic Rules are run by background jobs, all of which are disabled by default. A newly created rule will do nothing at all until the job for its processing type has been enabled in

Streaming rules are run by the normal stream processing jobs rather than by a job of their own.

The job frequency controls how often Stroom looks for schedules that are due, not how often a rule runs. A rule scheduled to run every ten minutes will not do so if the job that looks for due schedules only runs hourly.

Configuration

Some rule behaviour is set by system properties rather than on the rule itself.