Rule Catalog

Flarehawk ships 38 detection rules across five categories. Statistical and behavioral rules run on all domain tiers; ML and deep learning rules require the Complete tier. Use the tabs below to browse each category, or consult the rules overview to understand how rules fire and how severity is determined.

Basic tier domains run 25 statistical and behavioral rules. Complete tier domains run all 38 rules, including the full ML ensemble.

Security
Performance
Behavioral anomaly
ML
Enrichment

Security rules focus on authentication abuse, vulnerability scanning, known-bad IP traffic, and WAF event bursts. These are the highest-priority rules for detecting active attacks against your application.

Rule ID	Name	Description	Default severity	Available on
`auth_brute_force`	Authentication Brute-Force	Detects brute-force attacks on auth endpoints by tracking 401/403 failure ratios per IP with adaptive thresholds across common login, OAuth, and SSO paths.	warning / critical	Basic, Complete
`scanner_detection`	Vulnerability Scanner	Detects vulnerability scanners by analyzing path diversity, error bursts, and behavioral outliers in traffic patterns.	warning / critical	Basic, Complete
`auth_abuse_cusum`	Authentication Abuse	Detects sustained increases in failed login attempts, credential stuffing, and brute force campaigns on authentication endpoints.	warning	Basic, Complete
`abuseipdb_blacklist`	Blacklisted IP Traffic	Detects significant traffic originating from IPs on the AbuseIPDB blacklist, enriched with geolocation, ASN, and abuse confidence score.	warning / critical	Basic, Complete
`waf_rule_burst`	WAF Rule Burst	Detects sudden bursts in WAF rule triggers, indicating potential attack attempts or active exploitation campaigns. Monitors the rate of WAF blocks and challenges.	warning	Basic, Complete

Performance rules detect degradation in error rates, response times, and traffic volume. They alert you to availability issues that may indicate backend failures, resource exhaustion, or volumetric attacks.

Rule ID	Name	Description	Default severity	Available on
`traffic_spike_rpm`	Traffic Spike Detection	Detects sudden spikes in global request rate using adaptive baselines that learn from each domain’s historical traffic patterns, including time-of-day and day-of-week variation.	info / warning	Basic, Complete
`elevated_5xx_ratio`	Elevated 5xx Ratio	Flags an elevated share of 5xx error responses relative to an adaptive baseline, triggering when the current error rate significantly exceeds the domain’s learned normal.	warning	Basic, Complete
`path_5xx_spike`	Path-Specific 5xx Spike	Detects elevated 5xx error counts on specific paths using per-path baseline tracking to pinpoint problematic endpoints rather than aggregate error rates.	warning	Basic, Complete
`bandwidth_anomaly`	Bandwidth Anomaly (Per-Entity Adaptive)	Detects bandwidth anomalies using per-entity adaptive baselines for individual IPs, paths, and IP+path combinations. All thresholds are learned dynamically—no hardcoded limits.	warning / critical	Basic, Complete
`response_time_outlier`	Response Time Outlier	Detects abnormal response time patterns indicating performance degradation, resource exhaustion, backend service issues, or potential DoS conditions.	warning	Basic, Complete
`rate_limit_violation`	Rate Limit Violation	Detects excessive HTTP 429 (Too Many Requests) responses, identifying aggressive clients ignoring rate limits and burst patterns consistent with automated attacks.	warning	Basic, Complete

Behavioral anomaly rules detect unusual patterns in how requests are distributed across paths, user agents, IPs, HTTP methods, and geographic origins. They surface reconnaissance, scraping, and coordinated activity that statistical volume rules alone would miss.

Rule ID	Name	Description	Default severity	Available on
`rare_path_spike`	Rare Path Spike	Detects sudden spikes in requests to rarely-accessed paths, which can indicate scanning activity, exploitation attempts, or discovery of hidden or debug endpoints.	warning	Basic, Complete
`rare_ua_spike`	Rare User-Agent Spike	Detects sudden spikes in requests carrying rare user-agent strings, indicating bot activity, custom scrapers, exploitation tools, or scanning frameworks.	warning	Basic, Complete
`ip_rate_spike`	IP Rate Spike	Detects individual IPs sending abnormally high request rates compared to their historical baseline, using per-IP adaptive thresholds.	warning	Basic, Complete
`ip_path_rate_spike`	IP + Path Rate Spike	Detects abnormal request rates for specific IP and path combinations, useful for identifying targeted attacks or scanners hitting a particular endpoint.	warning	Basic, Complete
`http_method_anomaly`	HTTP Method Anomaly	Detects unusual HTTP method distributions, including rare or unexpected methods (TRACE, DELETE, PATCH) and sudden changes in method entropy that suggest scanning or exploitation.	warning	Basic, Complete
`geographic_anomaly`	Geographic Anomaly	Detects unusual geographic traffic patterns including sudden appearance of requests from new countries or significant deviation from the domain’s established geographic baseline.	warning	Basic, Complete

ML rules run an ensemble of models against traffic features extracted from each analysis batch. Each alert includes a confidence score. These rules require the Complete tier.

Rule ID	Name	Description	Default severity	Available on
`vae_behavioral_anomaly`	Behavioral Anomaly	Detects anomalous traffic patterns by learning what normal traffic looks like across multiple dimensions simultaneously. Includes feature attribution showing which traffic dimensions drove the alert.	info / warning	Complete only
`ensemble_meta_anomaly`	Ensemble Anomaly	Combines signals from all ML models with adaptive weighting. Fires high-confidence alerts when multiple models agree on anomalous behavior.	warning	Complete only
`graph_attention_anomaly`	Graph-Based Anomaly	Models relationships between IPs, ASNs, and paths to detect suspicious coordinated activity and botnet-like behaviors that appear innocuous on a per-IP basis.	warning	Complete only
`rnn_temporal_anomaly`	Temporal Anomaly	Detects attacks that unfold gradually over time by learning normal traffic cadence and flagging sequences that deviate from established patterns.	info / warning	Complete only
`transformer_sequence_anomaly`	Sequence Anomaly	Identifies unusual request ordering and coordinated patterns across time windows, effective at detecting sophisticated multi-phase attack campaigns.	warning	Complete only

Enrichment rules add contextual data to alerts rather than generating standalone alert events. They run alongside other detection rules and attach geolocation, ASN, and reputation data to triggered alerts.

Rule ID	Name	Description	Default severity	Available on
`ipinfo_enrichment`	IP Geolocation & ASN Enrichment	Enriches alert evidence with IP geolocation, ASN, ISP, and organization data from the IPInfo feed. Runs automatically alongside any rule that includes `top_ips` in its evidence configuration.	N/A (enrichment only)	Basic, Complete

Understanding the “Available on” column

Rules listed as Basic, Complete run on domains at any paid tier, including free-tier domains during the trial period. Rules listed as Complete only require a Complete tier domain—they are not evaluated for Basic tier domains, even if you attempt to enable them in Settings. If you upgrade a domain from Basic to Complete, ML rules begin their calibration period immediately. Full ML detection sensitivity is reached after seven days of training data.

The abuseipdb_blacklist rule depends on a continuously refreshed AbuseIPDB threat feed. Flarehawk syncs the blacklist hourly using a minimum confidence threshold of 75%. IPs that fall below this threshold are not checked against the rule.

Get Started

Core Concepts

Dashboard

Notifications

Detection

Flarehawk Intel

Billing

Understanding the “Available on” column

​Understanding the “Available on” column

Understanding the “Available on” column