Monitoring Rule
Noun · Security & Infosec
Definitions
A defined condition that tells a monitoring system when to raise an alert, create a case, or record a notable event. Monitoring rules may be based on thresholds, signatures, correlations, or behavioral patterns depending on the data source.
In plain English: A rule that tells a monitoring system what to watch for and when to alert.
Example: "The monitoring rule fired when the service account accessed a host it had never touched before outside its normal maintenance window."