> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Writing rules
> Turn scan observations into repeatable detections
Rules evaluate typed scan observations as they arrive. Use them to identify
exposed services, suspicious infrastructure, software, and protocol-specific
behaviour.
## Rule anatomy
Each source contains one YARA rule. Conditions read fields from the
`infrawatch` module.
```yara theme={null}
import "infrawatch"
rule Exposed_Redis_Without_Authentication {
meta:
description = "Redis accepted a probe without requiring authentication"
condition:
defined infrawatch.scan.redis.authentication_required and
infrawatch.scan.port == 6379 and
not infrawatch.scan.redis.authentication_required
}
```
The rule editor validates and formats source before a rule can be enabled.
## Detection metadata
Keep detection logic in the source. Set its meaning separately:
| Setting | Purpose |
| -------------- | ------------------------------------------ |
| Classification | `benign`, `suspicious`, or `malicious` |
| Categories | Slash-delimited paths such as `malware/c2` |
| Tags | The labels applied when the rule matches |
| Input | Scan results or certificate events |
See the [intelligence taxonomy](/platform/taxonomy) for the canonical category
paths and classification model.
## Write reliable conditions
* Prefer typed protocol fields over banner text.
* Check that an optional field is `defined` before using it.
* Combine independent signals to reduce false positives.
* Put reusable text or byte patterns in the `strings` section.
* Explain the detection intent in `meta.description`.
Start with compiled Redis, MQTT, and HTTP detections.
Find the exact path and type emitted by each scanner.