# Event rules

> Re-grade or suppress future Microsoft 365 events by country, region, network operator, user or tenant.

An event rule changes how future Microsoft 365 events are graded, or hides them from view, based on where or who they came from. Come here to quieten a known-safe source, to stop a whole country or network operator from raising alerts, or to check what a rule you created is doing.

> **Caution:** A rule affects events from the moment it's created or edited onwards. Classification happens once, when an event first arrives, so a new or changed rule doesn't re-grade events that already happened.

## What a rule does

A rule matches on one or more conditions and, when it matches, sets the **target grade** every matching event arrives at from then on:

- **Info, Warning, Danger or Critical** — future matching events arrive at that grade.
- **None** — the rule still matches and still counts as having hidden or re-graded something, but it doesn't change the event's grade. Use this to track how often a condition matches without altering anything.

## Every alert shows which rules touched it

Open any event or alert and its detail shows which rules matched it when it arrived and, if one of them changed its grade, which rule is responsible. This is the quickest way to check whether a rule is doing what you expect.

## The rules list

*Screenshot: Settings — Event Rules*

1. Create Rule
2. The rules table — Name, Scope, Conditions, Status, Modified

Status shows **Active**, **Pending** (its active period hasn't started yet) or **Expired** (it has ended). Hover it to see the dates.

## The rule dialog

*Screenshot: The rule dialog, General tab*

1. Rule name
2. Scope — Tenant or User
3. Conditions — Country, Region, ASN / Network, IP address

Target grade and the active period are set on the dialog's **Advanced** tab.

**Conditions.** A rule can combine any of:

- **Country** — the country the IP address resolves to.
- **Region** — a place you define: a point and a radius, so an office or a home can be approved precisely, even inside a country you haven't approved.
- **ASN / Network** — the operator behind the IP, such as Microsoft, AWS or a mobile carrier.
- **IP address** — exact addresses or CIDR ranges.

A condition you leave off isn't checked.

**Scope.** Choose **Tenant** or **User** before picking targets. Switching scope clears your selection, because it changes what "targets" means.

**Active period.** Either **Always active**, or a **custom schedule** of whole calendar days (in UTC) that the rule applies within. Both the start and end day are included.

## Drawing a region

Select **New region** from the conditions area to open a map. Place the centre point, then drag its edge handle to set the radius, name it, and select **Create region**. The new region is added to this rule's conditions and is available to every rule you create afterwards.

## Create a rule from Settings

1. Open Settings from the gear icon, then choose **Event Rules**.
2. Select **Create Rule**.
3. Name the rule, choose a scope, and set at least one condition.
4. Choose the target grade the rule should apply, or **None** to track matches only.
5. Set the active period, then select **Create rule**.

## Create a rule from an event or alert

1. Open the event or alert you want to build a rule from.
2. From the Country, Region, ASN or IP row, open its menu and select **Country rule**, **Region rule**, **ASN rule** or **IP rule**. For a rule starting from the actor, select **Create rule** in the sheet's footer.
3. Check the condition already filled in, adjust the rest, then select **Create and apply**.

Creating a rule this way also re-grades the event or alert you started from, straight away. This is the one exception to rules affecting only future events.

## Suppress a known-safe network operator

1. Find an event from the network operator you want to stop seeing, for example in the events table's filter or from the alert list.
2. Open its ASN menu and select **ASN rule**.
3. Set the target grade to **Info**, so matching events stop reaching Needs attention, or to **None** if you'd rather track how often it matches.
4. Leave the active period as **Always active**, then select **Create and apply**.

## Edit or delete a rule

1. Open Settings from the gear icon, then choose **Event Rules**.
2. Select the rule's row to edit it, or open its menu and select **Delete**.

## Actions

| Action      | What it does                                                        | Minimum role |
| ----------- | ------------------------------------------------------------------- | ------------ |
| View rules  | See the list of event rules and what each one matches               | L1 Read      |
| Create rule | Add a new rule                                                      | L2 Support   |
| Edit rule   | Change an existing rule's conditions, target grade or active period | L2 Support   |
| Delete rule | Remove a rule permanently                                           | L2 Support   |