Alert Rules
Declarative rules evaluated on imported captures (and on every platform they list). Rules are data only; imported rule files are validated, never run. Back to Baselines
Alert Rules
My Rules
Loading...
Default Rules (tracewaves.default 2026.10.0)
Defaults ship with the app. Customize makes your own copy with the same ID, which replaces the default; Start From makes a new rule based on it.
- LowNew BSSID for a baseline SSID
baseline.new_bssid · Access Point Observed · 2 conditions · cooldown 86400s · max 5/h
- LowBaseline BSSID not seen
baseline.missing_bssid · Baseline BSSID Missing · 0 conditions · cooldown 86400s · max 5/h
- HighSecurity mode downgraded
ap.security_downgrade · Security Downgraded · 0 conditions · cooldown 3600s · max 5/h
- MediumPMF disabled on a protected network
ap.pmf_disabled · Access Point Observed · 2 conditions · cooldown 86400s · max 5/h
- InfoChannel changed
ap.channel_change · Channel Changed · 0 conditions · cooldown 3600s · max 5/h
- LowBeacon interval changed
ap.beacon_interval_change · Access Point Field Changed · 1 condition · cooldown 3600s · max 5/h
- HighBaseline SSID from unexpected vendor
evil_twin.vendor_mismatch · Access Point Observed · 3 conditions · cooldown 3600s · max 5/h
- MediumOpen network appears
ap.open_appears · Access Point Added · 1 condition · cooldown 86400s · max 5/h
- HighWEP network present
ap.wep_present · Access Point Observed · 1 condition · cooldown 86400s · max 5/h
- CriticalKnown-exploited CVE matches a device
cve.kev_match · CVE Match · 1 condition · cooldown 604800s · max 5/h
- MediumBLE device seen across many sessions
ble.persistent_follower · BLE Device Persisting · 2 conditions · cooldown 86400s · max 5/h