Alert rules
Rules that act for you: when something keeps happening, slow the source, pause the key, end the session, ban, or tell you.
Open it now:AutomationNew rule
How a rule works
A rule watches one kind of event. Each time the event happens, Atlas counts it for the person it came from. When that person's count reaches the threshold inside the window, the rule's actions run once. For example: 15 failed sign-ins from one address within an hour bans that address for a day and emails you.
- Who is counted. The rule counts by what its actions act on: the license for a pause, a kill or a license ban, the hardware ID for a hardware ban, the address for an IP ban or a throttle. A rule that only notifies counts by whichever of license, hardware ID and address the event carries.
- Once per window. After a rule acts on someone it stays quiet for that person until the window has passed, so a persistent offender does not trigger the same email again and again.
- Several rules on one event are each counted and run on their own. That is how the defaults step up from a notice to a slowdown to a ban.
- No actions means the rule only records the event. The page shows it as Log only.
Events a rule can watch
These are the events Atlas raises. Thresholds and windows have a range per event; a value outside it is moved to the nearest allowed value when you save.
| Event | Fires when | Threshold | Window |
|---|---|---|---|
| Failed authentications | A wrong key, password or account, from one address. Account sign-ins count too. | 3 to 100 | 5 min to 24 h |
| Expired license attempts | An expired key tries to sign in. | 3 to 50 | 5 min to 24 h |
| Banned key retried | Something that is banned tries to sign in. | 1 to 20 | 1 min to 24 h |
| Concurrency exceeded | A key signs in on more sessions than it is allowed. | 2 to 50 | 5 min to 24 h |
| HWID mismatch | A key is used from a machine other than the one it locked to. | 2 to 20 | 5 min to 24 h |
| IP mismatch | A key is used from an address other than the one it locked to. | 2 to 20 | 5 min to 24 h |
| Geofence violation | A sign-in comes from a blocked country. | 1 to 10 | 1 min to 24 h |
| VPN detected | A sign-in is refused because the address is a VPN or proxy. | 1 to 50 | 1 min to 24 h |
| Rapid requests | A burst of requests from one source. | 10 to 500 | 30 s to 1 h |
| Unauthorized binary | A build that is not on the authorized list tries to sign in. | 1 to 10 | 1 h to 24 h |
| Client detection | The SDK in a customer's program reports that a runtime protection check tripped. | 1 to 20 | 1 min to 24 h |
| Network-flagged machine | A machine on the shared network flag list signs in. | 1 to 5 | 1 min to 24 h |
Actions
A rule can have any number of actions, from four groups, and the picker has a search box.
| Group | Action | What it does |
|---|---|---|
| Block | Ban the IP, Ban the hardware, Ban the license | One ban for the time you set, or permanent when you leave the duration empty. Whichever of these you pick, the ban covers the license, the hardware ID and the IP address the event carries, together. See below. |
| Block | Cascade ban, Account cascade ban | The same, always permanent. |
| Slow | Throttle the IP | Every connection from the address waits 3 seconds, for the duration you set, 10 minutes when empty. Requests still succeed. |
| Slow | Pause the license | Pauses the key and ends its live sessions now. Recoverable: resume it from its row. |
| Slow | Require re-auth | Accounts: forgets their trusted devices, so each re-verifies by email on the next sign-in. |
| Session | Kill the session | Ends every live session of the license. They can sign in again. |
| Session | Reset device binding | Clears the license's hardware ID and device so a real customer can re-bind. |
| Session | Revoke trusted devices | Accounts. Same as Require re-auth. |
| Notify | Post to Discord | Writes a WARN entry to the logs, Alert · rule name: event count/threshold in N s, which Atlas forwards to the application's Discord and JSON webhooks. A webhook with an event filter must include WARN. |
| Notify | Email the owner | Emails you what tripped, how often, the license, device and address, and what Atlas did. Once per offender per window. |
The default rules
Every application starts with these. They step up from a notice to a slowdown to a ban, so a small problem gets a small answer.
| Rule | Event | Count in window | Action |
|---|---|---|---|
| Slow down guessing | Failed authentications | 5 in 10 minutes | Throttle the IP for 15 minutes |
| Block key guessing | Failed authentications | 15 in 1 hour | Ban for 1 day, email you |
| License used on several devices | HWID mismatch | 3 in 1 day | Pause the license, email you |
| License used from several IPs | IP mismatch | 5 in 1 day | Email you |
| Possible key sharing | Concurrency exceeded | 3 in 1 hour | Kill the sessions, email you |
| Unwhitelisted build seen | Unauthorized binary | 1 in 1 hour | Email you |
| Repeated unwhitelisted build | Unauthorized binary | 3 in 1 day | Ban for 7 days |
| Banned re-entry | Banned key retried | 3 in 1 hour | Ban for 1 day |
| Blocked region retries | Geofence violation | 5 in 1 hour | Ban for 1 day |
| VPN retries | VPN detected | 10 in 1 hour | Throttle the IP for 30 minutes |
| Expired license hammering | Expired license attempts | 20 in 1 hour | Throttle the IP for 30 minutes |
Two system rules sit beside them: [SYSTEM] Session Limit Protection (10 concurrency violations in 5 minutes: ban for 30 minutes) and [SYSTEM] Backend Flood Protection (100 rapid requests in 1 hour: ban for 2 hours). They protect Atlas itself and cannot be edited, switched off or deleted.
- A rule on any of the ten events the defaults use (everything above except Client detection and Network-flagged machine) is marked Default, including a rule you add yourself: you can edit its threshold, window and actions and switch it off, but not delete it or change its event. Switching one off is how you retire it.
- Switching off a rule on Unauthorized binary asks you to confirm, and while any such rule is off a red banner reads Binary-hash enforcement is OFF. Switching off a rule on Rapid requests shows an amber Weakened defenses banner.
Add and edit rules
New rule (or Create your first rule on an empty page) opens the editor:
| Field | Notes |
|---|---|
| Rule name | Shown in the list, in the logs and in alert messages. Empty uses the event's name. |
| Event | Pick one from the grouped, searchable list. Choosing an event fills in its smallest allowed threshold and window. |
| Threshold, Window (minutes) | The count and the time it must happen in. The allowed range is under each field. |
| Actions | Tick any number. None means Log only. |
| Duration (minutes) | Appears with a ban or throttle action. Empty or 0 means permanent for a ban and 10 minutes for a throttle. |
Each row of the list reads like a sentence: If the event happens ×N in 1h, then the actions, with the ban length or permanent. The switch turns a rule on or off and keeps it with its history. An edit applies from the next event. The page needs the Alert rules permission.
Network flags
The Network flags card at the top is a switch for an opt-in shared list. Atlas flags a machine that signed in with unauthorized builds in at least 3 applications from at least 2 different sellers within 90 days. With the switch on, your application reports its own unauthorized-build machines to that list and raises Network-flagged machine when a flagged machine signs in. Nothing is blocked by itself: you decide with a rule. Your manual bans are never shared, and a flag expires after 90 days.
- Add blocking rule turns the switch on and adds Block flagged machines: ban the hardware for 30 days and post to your webhooks. Edit or delete it afterwards.
- When a flag is wrong, press Allow this machine on its row in Logs. The card then lists the machine under Allowed machines; Remove there undoes it.
- When on, the card also counts the machines your application reported in the last 90 days.