Rules guide

A rule is defined using XML-based language.

Rules are evaluated on the Endpoint by default. A matched rule triggers associated actions and notifies a security engineer by raising a detection. The detection is displayed in the Detections view. It is also exported to ESET PROTECT (or SIEM), or an email can be automatically sent when the detection is triggered.