Use Cases

The Use Cases view in Telemetry holds the rule catalog that drives Alerts. Each use case is a detection rule evaluated on a schedule by the AlertEngine over metadata events in the NeuralTrust telemetry store.

Predefined templates (nt-uc-NNN) ship with the platform. They are read-only — enable or disable them per team from the row action menu. To change a threshold or scope, author an equivalent custom rule and disable the predefined one.
Custom use cases are team-owned. Create them from scratch in the rule builder; Edit is offered in the detail panel for custom rules only.

Open Telemetry → Use Cases → Create use case (or edit an existing custom rule) to use the rule builder described below.

Rule builder tabs

The create/edit side panel has three tabs. Changes in Scope and Conditions compile live into the Rule preview tab.

General (Scope)

Set the rule name (required — the YAML title) and description (free text, shown as the human-readable logic in the use case detail), choose which products are in scope (TrustGate and/or TrustGuard), and narrow the scope with the two-level cascade described below. Leave a level empty to apply the rule to every target.

Conditions

Build match predicates (event attributes) and optional detection predicates (TrustGuard detector chain). Combine rows with And / Or connectors, optionally enable a time window, and set severity plus a default assignee.

Rule preview

Read-only YAML — exactly what AlertEngine stores and evaluates. Use this to verify the compiled rule before saving.

Products and condition fields

The Products involved selection on the General tab drives both the compiled source and the condition field picker, which shows only fields valid for that product:

TrustGate only → source: trustgate.
TrustGuard only → source: trustguard.
Both → source: cross. The Conditions tab switches to the cross builder: a TrustGate conditions list, a TrustGuard conditions list, and a Correlate on key. See Cross rules.

Scope

Scope is a two-level cascade per product. Pick the parent, then its children; an empty level means “no filter”.

Product	Parent	Child	Compiles to
TrustGate	Gateways	Consumers (loaded from the selected gateways)	`gateway_id` and `consumer` predicates
TrustGuard	Instances	Collectors (loaded from the selected instances)	`collector_id` predicate only

TrustGuard instances are a UI-only cascade that narrows which collectors are offered — there is no guard_id predicate field, so the instance selection is not persisted in the rule.

Conditions

AND / OR logic

Each condition row is a predicate: field · operator · value.

And between rows keeps predicates in the same group (all must match).
Or starts a new group. The compiler emits YAML any: — disjunctive normal form (OR of AND-groups).

Click the And / Or pill between rows to toggle the connector. Use And + or Or + under a row to insert a new condition with that connector.

Operators

Operator	Meaning	Typical value types
is (`eq`)	Equals	string, number, boolean, enum
in	One of (comma-separated list)	string, number, enum
contains	Substring match	string (e.g. security tags)
`>`, `≥`, `<`, `≤`	Numeric comparison	number

Boolean fields use True / False. Enum fields (status outcome, detection type, direction, protocol, kind) show allowed values in the picker.

Field picker

Fields are grouped in the dropdown for readability. Each option includes a short description. Groups:

Group	Contents
Outcome & status	Status code, status outcome, flagged, security tags
Request	Product-specific request metadata (route, model, provider, gateway/collector, policy, direction, protocol, …)
Identity	Consumer, consumer name, session, trace ID
Latency & usage	Latency breakdown, token usage, cost (TrustGate); detector/overhead latency (TrustGuard)
MCP	MCP method, tool, server name (TrustGate only)
Detection	Detection type, action, confidence, enforced (TrustGuard only)

See Event schema for how each logical field maps to stored events.

TrustGate condition fields (24)

Field	Value type · operators	Description
`status.code`	number · `is` `in` `>` `≥` `<` `≤`	HTTP status code returned for the request (e.g. 200, 403, 500)
`status.outcome`	enum · `is` `in`	Final policy outcome after evaluation: `block`, `transform`, `report`, `allow`
`model`	string · `is` `in` `contains`	LLM model name from the request metadata
`is_flagged`	boolean · `is`	True when any detector fired or the outcome is not `allow`
`security`	string · `contains`	Security tag labels attached to the event; matches a label substring
`session`	string · `is` `in`	Session identifier grouping related requests from the same user or agent
`consumer`	string · `is` `in`	Consumer (entity) ID — the principal making the request
`consumer.name`	string · `is` `in` `contains`	Consumer display name
`trace_id`	string · `is` `in`	Trace ID linking the event to its raw payload and to cross-product correlation
`http_method`	string · `is` `in`	HTTP verb (GET, POST, …)
`total_ms`	number · `is` `in` `>` `≥` `<` `≤`	Total end-to-end request latency (ms)
`provider`	string · `is` `in` `contains`	Upstream LLM provider (e.g. `openai`, `anthropic`)
`route`	string · `is` `in` `contains`	HTTP URL path
`gateway_id`	string · `is` `in`	TrustGate gateway that handled the request
`kind`	enum · `is` `in`	Request kind: `llm`, `mcp`, `a2a`
`latency.provider_ms`	number · `is` `in` `>` `≥` `<` `≤`	Time spent waiting on the upstream provider (ms)
`latency.gateway_ms`	number · `is` `in` `>` `≥` `<` `≤`	Time spent inside the TrustGate gateway (ms)
`usage.total_tokens`	number · `is` `in` `>` `≥` `<` `≤`	Input plus output tokens consumed
`usage.input_tokens`	number · `is` `in` `>` `≥` `<` `≤`	Prompt/input tokens consumed
`usage.output_tokens`	number · `is` `in` `>` `≥` `<` `≤`	Completion/output tokens returned
`cost.total_usd`	number · `is` `in` `>` `≥` `<` `≤`	Estimated total request cost (USD)
`mcp.method`	string · `is` `in` `contains`	MCP JSON-RPC method name
`mcp.tool`	string · `is` `in` `contains`	MCP tool name when the call invokes a tool
`mcp.server_name`	string · `is` `in` `contains`	Registered MCP server name

TrustGuard condition fields (23)

Includes all Outcome, Identity, and shared fields above, plus:

Field	Value type · operators	Description
`collector_id`	string · `is` `in`	TrustGuard collector instance that evaluated the request
`collector_name`	string · `is` `in` `contains`	Collector display name
`direction`	enum · `is` `in`	Whether the event is an `input` (prompt) or `output` (response) evaluation
`protocol`	enum · `is` `in`	Request protocol: `llm`, `mcp`, `a2a`
`policy_id`	string · `is` `in`	Runtime policy that evaluated the request
`policy_name`	string · `is` `in` `contains`	Runtime policy display name
`latency.detectors_ms`	number · `is` `in` `>` `≥` `<` `≤`	Time spent running TrustGuard detectors (ms)
`latency.overhead_ms`	number · `is` `in` `>` `≥` `<` `≤`	Processing overhead outside detectors (ms)
`detection.type`	enum · `is` `in`	Normalized detection category: `prompt_injection`, `secrets`, `pii`, `toxicity`
`detection.action`	enum · `is` `in`	Action the detector took: `block`, `transform`, `allow`
`detection.confidence`	number · `is` `in` `>` `≥` `<` `≤`	Detector confidence score between 0 and 1
`detection.enforced`	boolean · `is`	True when the action is `block` or `transform` (policy was enforced)

TrustGuard detection.* fields compile into a separate detection: block in the rule YAML (matched over the normalized detector chain). All other fields compile into match:.

There is no jailbreak detection type. The engine normalizes jailbreak signals — and anything raised by the prompt_guard / tool_guard plugins — into detection.type = prompt_injection. To match jailbreaks specifically rather than all injection attempts, filter on the security tag with contains instead.

IP address is not a supported field. There is no ip column in the metadata store. Group by session or consumer instead of IP for surge and anomaly rules.

Time window

Enable Time window to require a minimum number of matching events within a rolling period before the rule fires (windowed count) instead of alerting on every single match. When enabled, configure:

Control	Description
Amount + unit	Window length (minutes or hours)
Per (group by)	Entity bucket the count is kept per: Consumer (default, `entity`), Session, App (gateway or collector), or Route (TrustGate only)

The threshold is not editable in the builder today. Single-product rules compile with a fixed threshold: 5 — five matching events per bucket within the window. Only the window duration and group-by are exposed; cross rules do render a threshold input. Always check Rule preview for the threshold that will actually be stored.

Group-by entity and consumer both resolve to the consumer ID, and entity is the engine default — so it is omitted from the compiled YAML.

Alert output

Setting	Description
Severity	Default severity for alerts from this rule: Low, Medium, High, Critical
Default assignee	Optional team member pre-assigned when the alert is raised

Scope selections from the General tab are compiled as additional predicates (gateway_id, consumer, collector_id) when specific targets are selected — a level left empty adds no predicate.

Cross rules

Selecting both products turns the Conditions tab into the cross builder, which compiles to source: cross:

Control	Description
TrustGate conditions	Predicates on gateway traffic. `match` only — the engine rejects detection predicates on the gate side
TrustGuard conditions	Predicates on guard events, including `detection.*`
Correlate on	Shared key joining a gateway event to a guard event: Consumer (`entity`, default) or Session
Time window	Required for cross rules
Threshold	Optional here: minimum correlated events within the window before alerting

Each side needs at least one predicate — a condition row or a scope selection.

Example compiled rules

Per-event TrustGuard detection (similar to nt-uc-101)

title: "High-Confidence Threat"
description: "Blocked threat with confidence >= 0.90"
source: trustguard
severity: high
kind: per_event
detection:
  - field: detection.confidence
    gte: 0.90
  - field: detection.action
    eq: "block"

Windowed TrustGate auth anomaly (similar to nt-uc-201)

title: "Auth Anomaly"
source: trustgate
severity: high
kind: windowed
window: 5m
group_by: session
threshold: 10
match:
  - field: status.code
    in: [401, 403]

OR groups (401 or 403 per event)

kind: per_event
source: trustgate
any:
  - match:
      - field: status.code
        eq: 401
  - match:
      - field: status.code
        eq: 403

Rule kinds (evaluation models)

`kind`	Fires when	YAML extras
`per_event`	Any single matching event	—
`windowed`	Event count ≥ `threshold` per `group_by` within `window`	`window`, `group_by`, `threshold`
`aggregate`	Metric (ratio, p95, avg, sum, count_distinct) crosses threshold	`metric:` block
`cross`	TrustGate ⋈ TrustGuard on `correlate_on`	`gate:`, `guard:` selections

The builder emits per_event (time window off), windowed (time window on) and cross (both products selected). It also compiles an aggregate count_distinct rule when the measure is set to distinct, but that control is not yet exposed in the UI — the remaining aggregate metrics (ratio, p95, avg, sum) are available in predefined templates or by editing YAML directly.

Alerts

The raised findings, triage workflow, and predefined catalog.

Event schema

Event schema, detection normalization, and field mapping for rule authors.

Integrations

Forward findings to Splunk and other SIEMs as OCSF events.

Overview

Organization

Identity & Access

Telemetry

Audit & Compliance

Deployment

Use Cases

Use Cases

Rule builder tabs

Products and condition fields

Scope

Conditions

AND / OR logic

Operators

Field picker

TrustGate condition fields (24)

TrustGuard condition fields (23)

Time window

Alert output

Cross rules

Example compiled rules

Per-event TrustGuard detection (similar to nt-uc-101)

Windowed TrustGate auth anomaly (similar to nt-uc-201)

OR groups (401 or 403 per event)

Rule kinds (evaluation models)

Alerts

Event schema

Integrations

​Use Cases

​Rule builder tabs

​Products and condition fields

​Scope

​Conditions

​AND / OR logic

​Operators

​Field picker

​TrustGate condition fields (24)

​TrustGuard condition fields (23)

​Time window

​Alert output

​Cross rules

​Example compiled rules

​Per-event TrustGuard detection (similar to nt-uc-101)

​Windowed TrustGate auth anomaly (similar to nt-uc-201)

​OR groups (401 or 403 per event)

​Rule kinds (evaluation models)

​Related documentation

Alerts

Event schema

Integrations

Use Cases

Rule builder tabs

Products and condition fields

Scope

Conditions

AND / OR logic

Operators

Field picker

TrustGate condition fields (24)

TrustGuard condition fields (23)

Time window

Alert output

Cross rules

Example compiled rules

Per-event TrustGuard detection (similar to nt-uc-101)

Windowed TrustGate auth anomaly (similar to nt-uc-201)

OR groups (401 or 403 per event)

Rule kinds (evaluation models)

Related documentation