📄️ Overview
Policies let you transform alerts that match your criteria: change fields (severity, tags, attributes, …), optionally run a custom tool, on an event trigger or a fixed schedule. They run in priority order (lower number first), similar to notification rules, but they modify alerts instead of sending messages.
📄️ Creating a policy
Route: /policies
📄️ Conditions
Route: /policies (Conditions step of the policy wizard)
📄️ Modifiers and tools
Route: /policies (Actions step of the policy wizard — tabs Modifiers, Extractions, and Run a tool)