Event rules

An event rule changes how future Microsoft 365 events are graded, or hides them from view, based on where or who they came from. Come here to quieten a known-safe source, to stop a whole country or network operator from raising alerts, or to check what a rule you created is doing.

Caution

A rule affects events from the moment it’s created or edited onwards. Classification happens once, when an event first arrives, so a new or changed rule doesn’t re-grade events that already happened.

What a rule does

A rule matches on one or more conditions and, when it matches, sets the target grade every matching event arrives at from then on:

• Info, Warning, Danger or Critical — future matching events arrive at that grade.
• None — the rule still matches and still counts as having hidden or re-graded something, but it doesn’t change the event’s grade. Use this to track how often a condition matches without altering anything.

Every alert shows which rules touched it

Open any event or alert and its detail shows which rules matched it when it arrived and, if one of them changed its grade, which rule is responsible. This is the quickest way to check whether a rule is doing what you expect.

The rules list

12

Settings — Event Rules

1. Create Rule
2. The rules table — Name, Scope, Conditions, Status, Modified

Status shows Active, Pending (its active period hasn’t started yet) or Expired (it has ended). Hover it to see the dates.

The rule dialog

123

The rule dialog, General tab

1. Rule name
2. Scope — Tenant or User
3. Conditions — Country, Region, ASN / Network, IP address

Target grade and the active period are set on the dialog’s Advanced tab.

Conditions. A rule can combine any of:

• Country — the country the IP address resolves to.
• Region — a place you define: a point and a radius, so an office or a home can be approved precisely, even inside a country you haven’t approved.
• ASN / Network — the operator behind the IP, such as Microsoft, AWS or a mobile carrier.
• IP address — exact addresses or CIDR ranges.

A condition you leave off isn’t checked.

Scope. Choose Tenant or User before picking targets. Switching scope clears your selection, because it changes what “targets” means.

Active period. Either Always active, or a custom schedule of whole calendar days (in UTC) that the rule applies within. Both the start and end day are included.

Drawing a region

Select New region from the conditions area to open a map. Place the centre point, then drag its edge handle to set the radius, name it, and select Create region. The new region is added to this rule’s conditions and is available to every rule you create afterwards.

Create a rule from Settings

1. Open Settings from the gear icon, then choose Event Rules.

2. Select Create Rule.

3. Name the rule, choose a scope, and set at least one condition.

4. Choose the target grade the rule should apply, or None to track matches only.

5. Set the active period, then select Create rule.

Create a rule from an event or alert

1. Open the event or alert you want to build a rule from.

2. From the Country, Region, ASN or IP row, open its menu and select Country rule, Region rule, ASN rule or IP rule. For a rule starting from the actor, select Create rule in the sheet’s footer.

3. Check the condition already filled in, adjust the rest, then select Create and apply.

Creating a rule this way also re-grades the event or alert you started from, straight away. This is the one exception to rules affecting only future events.

Suppress a known-safe network operator

1. Find an event from the network operator you want to stop seeing, for example in the events table’s filter or from the alert list.

2. Open its ASN menu and select ASN rule.

3. Set the target grade to Info, so matching events stop reaching Needs attention, or to None if you’d rather track how often it matches.

4. Leave the active period as Always active, then select Create and apply.

Edit or delete a rule

1. Open Settings from the gear icon, then choose Event Rules.

2. Select the rule’s row to edit it, or open its menu and select Delete.

Actions

Action	What it does	Minimum role
View rules	See the list of event rules and what each one matches	L1 Read
Create rule	Add a new rule	L2 Support
Edit rule	Change an existing rule’s conditions, target grade or active period	L2 Support
Delete rule	Remove a rule permanently	L2 Support