id,name,event_a_source_glob,event_a_category,event_a_action_glob,event_b_source_glob,event_b_category,event_b_action_glob,same_actor,max_seconds,severity,summary_template,enabled,created_at
1,bc_login_to_perm_grant,bc:account,login,%,bc:account,permission,changed,1,300,warning,"BC chain: actor {actor} logged in, then granted permission within {seconds}s",1,2026-05-21 07:04:52
2,bc_perm_grant_to_app_install,bc:account,permission,changed,bc:account,app,installed,1,600,warning,"BC chain: actor {actor} was granted permission, then installed app within {seconds}s",1,2026-05-21 07:04:52
3,ss_new_user_then_url_change,shipstation:state_detector,,%new_user%,shipstation:state_detector,,%external_url%,0,600,critical,ShipStation: new user followed by store URL change within {seconds}s,1,2026-05-21 07:04:52
4,dsm_authfail_then_advisor,dsm:auth,,%fail%,dsm:advisor:summary,,,0,1800,warning,DSM: auth failure followed by Security Advisor severity update within {seconds}s,1,2026-05-21 07:04:52
5,ct_unauthorized_then_cf_state,cloudflare:ct_logs,,,cloudflare:state_diff,,,0,3600,critical,CT log entry followed by Cloudflare config change within {seconds}s,1,2026-05-21 07:04:52
6,bc_perm_change_then_app_remove,bc:account,permission,changed,bc:account,app,removed,1,1800,info,"BC chain: actor {actor} changed permission, then removed app within {seconds}s",1,2026-05-21 07:04:52