Learn · Concepts
Core concepts
The four steps — watch, think, act, record — and the words we use.
Everything the platform does runs the same four steps. It watches (a data feed comes in), it thinks (the event is weighed against your rule packs), it acts (tell someone, stop something, fix something, or ask a person), and it records (every step is written to the logbook). Learn that once and every screen makes sense.
The words
- The thing being observed: a sensor, an account, a route, a bot.
- One piece of incoming activity about a watched thing.
- The labels a rule can use: groups, warning labels, and examples.
- When something is seen, do something — from the fixed action list.
- The unchangeable record of what was seen and what was done.
- A bundle of rulebooks, logic, and rules that shapes one job.
- The part of your organization that owns its own data and logbook.
- How serious a warning label is, 1–5.
- The platform pauses and a person decides before anything happens.
What a rule can do
A rule says: when this warning label is seen, do that. The "that" always comes from one fixed list of actions, the same everywhere: write it down; tell a person (notify, review, escalate); gate the action (allow, challenge, hold, block); or fix it (turn off access, switch off, open a ticket, call your system). Rule packs add labels — they can never add actions.
When rules disagree, the most careful one wins. And when an action is sensitive, it is held for a person: nothing happens until someone approves, and the approval itself is written down.