Skip to main content
Policies in Quint are two things, and the evidence between them. Rulesets say what your machines should notice. Alerts tell people what the rules noticed: when a rule refuses an action, when a threshold is crossed, or on a schedule. Both work from matches. The Policies page is a hub: a chart of your matches and a card for each section, each opening its own page. Rules is “The rules your machines run, and what each one matched.” Caught actions is “Every agent action a rule noticed, newest first.” Versions is “Every published version of your rules.” Enforcement is “Whether rules can refuse actions on your machines, and what turning it on changes.” Alerts & incidents is “Who is told when a rule matches, and when an incident opens.”

​
Rulesets

A ruleset (also called a policy pack) is a versioned, signed set of rules. Each rule is one disposition over conditions:
  • The disposition is what the rule wants: record, ask or refuse.
  • The conditions name what the rule is about, across up to six kinds of matcher. All kinds you fill in must match. Within one kind, any one value is enough.
A ruleset has a review-and-publish step. Each published version gets a serial. Machines receive the published serial.

​
Matches

When a rule’s conditions fit an action, the dashboard records a match. A match means a rule noticed the action. It is evidence for you to read, not a judgement that the action was wrong.

​
Alerts

The Alerts tab holds only what your rules send. The refused-action alert tells your channels when an armed rule refuses an action, and opens an Incident. A scheduled summary (recap) sends counts and rule names to a Slack, Teams or alert-webhook destination you already set up on Integrations. A summary can carry match thresholds, which send a message when refuse matches reach a number you set within a fixed UTC window. Each shows the channels it is sent to; channels are turned on and off on Integrations. An alert tells a person something; it never changes what a machine does. See Alerts. The three built-in alerts that do not come from a rule (divergence, unusual activity and the risk score limit) are on Settings › Notifications.

​
Shadow mode first

Every ruleset starts in shadow mode. In shadow mode a rule only records. The Shadow Enforcement page then shows you, against the real traffic of the last 14 days, what each rule would have done: “would have asked”, “would have refused”. Nothing is interrupted. You arm your rules when the shadow results look right. Arming is one workspace switch, Enforcement, which an owner or admin turns on. The switch sets the mode of the ruleset your machines are served by re-signing it: turning it on signs your current rules again in enforce mode, as a new version, and turning it off signs them again in shadow mode. The rules themselves don’t change. While the switch is off, your own rules record and nothing else.
Arming enforcement is a step you take together with your Quint contact. Read Shadow enforcement first.

​
What happened to watch profiles

The Profiles tab was retired. Sensitive-path settings an organisation already declared remain active and continue to reach its machines. The dashboard no longer shows or edits them; an administrator can inspect or change them through the API. Everything else a profile held never changed what a machine did.

​
Where to go next