Rule Builder is available with a paid SecurityScorecard plan. See our plans page for more information about levels of features and access.
Rules let you automate actions based on Scorecard activity, such as score changes or new high-severity issues. In this article, you’ll learn how to create a rule using recommended rules from a Scorecard or by creating a rule manually in the Rule Builder.
For information on how to schedule a recurring report, see this article.
Use recommended rules
Recommended rules are generated based on the context of the Scorecard you’re viewing, such as recent score changes, issue severity, or risk tier movement. These rules are preconfigured with relevant fields, which you can edit before saving.
- While viewing a Scorecard, select Recommended Rules.
- The New Automation panel opens, showing a list of suggested rules based on the current Scorecard.
- Select a recommendation to open a pre-filled rule template.
- Review the rule details and make any needed changes.
- Select Save to create the rule.
Create a rule manually
Use this option when you want full control over the rule logic or when recommendations do not cover your use case. This procedure covers rules that run when an event occurs, such as a Scorecard change or a new high-severity issue.
- Go to Automation > Rule Builder and select Create Rule.
- Select Events to trigger the rule when a specific event occurs (for example, a new issue is detected, a score change).
- Use a descriptive name that explains what the rule does. For example, "Notify me when critical issues appear" instead of "Issue alert".
- Choose the scorecard(s) this rule should monitor. You can create rules for:
- Your organization's scorecard
- A single scorecard
- A custom scorecard
- Select the event that must happen for the rule to run. Examples include:
- Score drops below a minimum threshold
- New Observation with severity High or Critical appears
- Vendor moves into a different risk tier
- Define the action that should occur after an event.
- Review your changes and Save your rule.
You’ll receive a notification each time the event occurs and the rule runs.
Understand Scorecard events
Events tell your rule when to run. They fall into a few core categories: new issues, score changes, or specific shifts in risk indicators. You’ll choose one of these events to trigger your rule.
New issue detection
Use when you want to know as soon as something new appears.
| Event | Description |
| New issue by app signal | A signal from one of our partners, such as Intsights reports that your domain was mentioned on the Dark Web. |
| New issue by severity level | A new score-impacting issue with a high, medium, or low severity level |
| New issue by issue type |
A finding for a specific issue type, such as:
|
Score changes - overall Scorecard
Use these when you want to track overall risk movement across any Scorecard, whether that be your own, a vendor’s, or a portfolio you monitor.
| Event | Description |
|
Overall letter grade change |
A rise or drop in a Scorecard's overall letter grade against a certain threshold, such as:
|
|
Overall numeric score change |
A rise or drop in a Scorecard's overall numeric score against a certain threshold, such as:
|
|
Overall numeric score change by percentage |
A rise or drop in a Scorecard's overall numeric score by percentage, such as:
|
Score changes - Specific factor
Use when you care about what changed inside the Scorecard, not just that it changed.
| Event | Description |
|
Factor letter grade change |
A rise or drop in a factor letter grade against a certain threshold, such as:
|
|
Factor numeric score change |
A rise or drop in a factor's numeric score against a certain threshold, such as:
|
|
Factor numeric score change by percentage |
A rise or drop in a Scorecard's factor numeric score by percentage, such as:
|
Understand rule actions
Learn how actions work so that you can create the best response to an event.
| Action | Description |
|
Add to portfolio |
Copy the affected Scorecard to another portfolio while also keeping it in the original portfolio. As the owner of the rule, you receive a notification of the event in the Daily Digest email and in the Notifications section of the platform. |
| Remove from portfolio | Remove the affected Scorecard from a specified portfolio. |
|
Share report |
Generate a Summary or Detailed report in Report Center and email a notification of its availability to a specified address. As the owner of the rule, you receive a notification of the event in the Daily Digest email and in the Notifications section of the platform. |
|
Send alert (Only available to SSC administrators) |
Email an alert yourself or a teammate. In the latter case, as the owner of the rule, you receive a notification of the event in the Daily Digest email and in the Notifications section of the platform. |
|
Send a web request |
Use webhooks to generate automated messages sent from apps. |
|
Use an action from a partner app or integration |
Specify an action from an app or integration that you install from Integrate360° Marketplace, such as: |