---
title: Severity Rules
slug: severity-rules
docTags:
createdAt: 2026-06-23T19:39:52.649Z
---
Event severity is a classification that helps you evaluate and respond to exposures and threats. It gives you a quick assessment on how serious a given Event is, based on contextual sensitivity and threat indicators. Each Event in your Tenant is assigned one of five severity levels, ranked from `Info` to `Critical`, using a framework developed by Flare to provide a standardized risk indicator across all teams monitoring threats.
Severity Rules are the building blocks behind the severity assigned to an Event. Each rule pairs a saved query with a severity, and when an Event matches a rule, the rule is applied and contributes to the Event's final severity.
There are two types of Severity Rules:
::::LinkArray{contentSource="CUSTOM" itemsPerRow="2"}
:::LinkArrayItem
Added and maintained centrally by Flare. These rules provide coverage out of the box, so every organization can benefit from them. Flare Rules cannot be edited, but they can be turned on or off, and the severity level can be changed.
:::
:::LinkArrayItem{headerType="NONE"}
Created in your Tenant and maintained by your organization to cover your context. For example, flagging Events that mention a specific internal codename. These rules apply only in the Tenant where they were created.
:::
::::
:::hint{type="warning"}
**Important to note**
Changes to a Flare or Custom Severity Rule are not applied retroactively. Creating or modifying a rule affects only the Events that arrive after the change. The severity already assigned to past Events is not recalculated to reflect the new rule.
:::
# Flare Severity Rules
These rules are available on all Tenants and are maintained centrally by Flare. While these rules can't be edited, they can be turned on/off, and the severity level can be changed. Follow these steps to view and manage the Flare Severity Rules:
::::WorkflowBlock
:::WorkflowBlockItem
Navigate to the Identifiers page from the navigation menu on the left.
:::
:::WorkflowBlockItem
Click on the Severity Rules tab. Flare Rules are labeled Flare in the Type column.
:::
:::WorkflowBlockItem
Click on a rule to view its details.
::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/r6UoFwMbWxvRjd1MgplEP_image.png" size="70" isUploading="false" width="1238" height="850" darkWidth="1238" darkHeight="850" position="flex-start" showCaption="false"}
:::
:::WorkflowBlockItem
You can make the following changes to a Flare Severity Rule:
- Change the severity level by selecting the required value.
- Activate or deactivate the rule using the Active toggle.
:::
:::WorkflowBlockItem
Click Save to apply your changes.
:::
::::
:::hint{type="info"}
### Changing a Flare Rule
You can diverge from a Flare Rule's default behavior by:
1. Changing the default severity of a Flare Rule.
2. Disabling the Flare Rule and creating a Custom Rule in its place.
Any changes apply to your Tenant only, without affecting the rules for any other Tenant. To restore the Flare default, activate the disabled Flare Rule and remove the Custom Rule, with no lasting side effects on future Events. Events that were assigned a severity before the change are not re-evaluated.
:::
***
# Custom Severity Rules
Custom Severity Rules can be created for each individual Tenant and determine the severity for the Events in that Tenant only. Follow these steps to create a Custom Severity Rule:
::::WorkflowBlock
:::WorkflowBlockItem
Navigate to the Identifiers page from the navigation menu on the left.
:::
:::WorkflowBlockItem
Select the Severity Rules tab, then select Create Rule.
::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Mdn8KFc3E3O64sbe5HZcg_image.png" size="70" isUploading="false" width="1242" height="1162" darkWidth="1242" darkHeight="1162" position="flex-start" showCaption="false"}
:::
:::WorkflowBlockItem
Enter a name and description, then add a query using [Lucene syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html) to match the relevant Events. For additional guidance on writing queries, see [Queries](docId\:P1KzNpx-Y9g6Yp2CrvsSv) and [Building advanced queries.](docId:8YkwPTlf5D76xqWA1FwYv)
:::
:::WorkflowBlockItem
Select one or more Event categories and assign the severity level to apply to all matched Events.
:::
:::WorkflowBlockItem
To give the rule precedence over any other rule that matches the same Event, enable the Make this an override toggle. For more information, see [How severity is calculated.](docId\:LtSDxTP9nCx7-FOhtDSMK)
:::
:::WorkflowBlockItem
Use the Active toggle to activate or deactivate the rule.
:::
:::WorkflowBlockItem
Click Save to apply your changes.
:::
::::
***
# How Severity is Calculated
When an Event is matched to your Identifiers, it is checked against every Flare Severity Rule and any Custom Severity Rules you have defined. Every active rule that matches is considered to determine the Event's final severity.
To understand how the final severity is decided, it is important to know that every rule behaves in one of two ways, depending on the override toggle.
::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/6FEIlSnXbeR8MMIHcbiyF_image.png" size="70" isUploading="false" width="1146" height="448" darkWidth="1146" darkHeight="448" position="flex-start" showCaption="false"}
- A **Set rule** is a rule with the override option disabled. It proposes a severity, which is applied directly when it is the only rule that matches. When other rules also match, its severity is weighed against theirs to decide the final result.
- An **Override rule** is a rule with the override option enabled. It forces its severity over any Set rules that match the same Event.
### How a tie is settled
1. If there are multiple Set rules, but no Override rule, the Event takes the highest severity proposed by the Set rules.
2. If an Override rule matches, it wins, forcing its severity and ignoring any Set rules.
3. If several Override rules match, the one with lowest severity wins.
4. If there are no matching rules, the final severity is `Info`.
::::Tabs
:::Tab{title="Logic Flowchart"}
:::
:::Tab{title="Logic Matrix"}
::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/glZZDhrWGri5YHNsFUeq8_image.png" size="80" isUploading="false" width="1012" height="846" darkWidth="1012" darkHeight="846" showCaption="false"}
:::
::::
### Example of multiple matching rules
Here is an example showing what happens when an Event matches multiple rules:
| **Match 1** | **Match 2** | **Final severity** | **Why** |
| --------------- | ----------------- | ------------------ | -------------------------------------------------- |
| Set High | Set Medium | High | The Set rule with the highest severity wins |
| Set High | Override Low | Low | An Override always wins over a Set rule |
| Set Medium | Override Critical | Critical | An Override can raise severity as well as lower it |
| Override Medium | Override Critical | Medium | When several Overrides match, the lowest one wins |
The reason for every rule that was applied to an Event is shown in the Event details, so you can see exactly why an Event received its severity level.
***
# FAQs
:::ExpandableHeading
### Do changes to a Severity Rule affect past Events?
No. Rule changes apply going forward only. Creating, editing, disabling, or overriding a rule does not recompute the severity of Events that were already scored before the change.
:::
:::ExpandableHeading
### Is disabling or overriding a Flare rule reversible?
Yes. Clearing the override, or turning the Flare Rule back on, restores the default behavior with no lasting side effects. As noted above, Events scored while the override was active are not rescored.
:::
:::ExpandableHeading
### Why do some of my rules appear as Beta?
Some Rules are flagged Beta while still being validated in production. These rules display a badge next to their name and may be tuned or adjusted based on how they perform across Tenants.
:::
###