> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.
# Detection Rules
> Define, customize, and manage vulnerability detection logic using rule-based scanning.
## Overview
Detection Rules are the core of how vulnerabilities are identified.
They simulate attacker behavior by modifying requests and analyzing responses to detect security flaws.
***
## Rule Categories
Rules are grouped into categories for better organization:
* CRLF
* Authentication & Authorization
* Command Injection
* CORS
* Database Injection
* Error Handling & Logs
* File Inclusion
* Open Redirect
* Security Headers
* Sensitive Data Exposure
* SSRF
* XSS
* XXE
***
## Creating a Rule
Use **Create Rule** to define custom detection logic.
Each rule allows you to simulate real attack scenarios and detect application weaknesses.
***
## YAML-Based Rule Engine
Rules are written in YAML and consist of:
### Core Sections
* **Transform**
* Modify headers, query params, or body
* **Match Conditions**
* Status codes
* Response content
* **Report**
* Title
* Description
* Severity
* CWE
* CVSS
* Impact
* Mitigation
* Reproduction Steps
***
## Rule Execution Logic
Rules work by:
1. Modifying the original request
2. Sending the transformed request
3. Analyzing the response
4. Flagging unexpected behavior as vulnerabilities
***
## Rule Management
Each rule provides:
* Enable / Disable toggle
* Severity classification
* Detection description
* Number of findings
***
## Editing Rules
Rules can be modified anytime to:
* Improve detection accuracy
* Reduce false positives
* Adjust logic for application-specific behavior
***
## Deep Rule Customization
The editor allows full control over:
* Request transformations
* Matching conditions
* Reporting output
This enables detection of:
* Business logic flaws
* Authorization bypass
* Misconfigurations
* Edge-case vulnerabilities
***
## Why It Matters
Detection Rules turn your scanner into a customizable security engine.
### Key Benefits
* Adapt scanning to your application logic
* Detect beyond standard vulnerability signatures
* Reduce noise with precise matching
* Align findings with real-world attack patterns
* Enable security teams to build reusable detection logic
***
## Explore Live Demo
Create, test, and deploy custom detection logic tailored to your applications.