Workflow

Define automatic actions when threats are detected. Create IF/THEN rules that respond to each type of threat with logging, blocking, notifications, or custom workflows. Changes apply in real-time.

Workflow Rules

The Workflow tab lists all active automation rules for your project, with three buttons in the top right:

• + Add Rule: Create a new automation rule
• Export config: Download all rules as a JSON file
• Advanced Config: Open the advanced configuration panel

Cloud / Web / API projects:

Click to expand

On-Premise / Desktop / Mobile projects:

Click to expand

Creating a Rule

Each rule follows an IF/THEN pattern:

1. Click + Add Rule
2. IF: Select the protection module (SQL Injection, Debugger Detection, Command Injection, etc.)
3. THEN: Check the actions to execute when this threat is detected

Available actions depend on your project type:

You can select multiple actions per rule. For example, a SQL Injection rule can Log the incident, Block the request, and Block the IP simultaneously.

Deleting a Rule

Click the trash icon on any rule to remove it. The change applies immediately.

Notifications

Each rule can trigger notifications to alert your team in real-time.

Slack

1. Check the Slack checkbox on the rule
2. Click Link Slack with ByteHide to connect your workspace
3. Select the channel to receive alerts

Webhook

1. Check the Webhook checkbox on the rule
2. Select a webhook from the dropdown (or create one)
3. Monitor sends a POST request with the full incident data to your endpoint

Use webhooks to integrate with:

• SIEM systems (Splunk, ELK, Datadog)
• Ticketing (Jira, ServiceNow, PagerDuty)
• Custom alerting pipelines

Export Configuration

Click Export config to download your current workflow rules as a JSON file. This is useful for:

• Version-controlling your security configuration
• Copying rules between projects
• Using as a base for JSON Configuration in offline environments

Advanced Configuration

Click Advanced Config to open the advanced settings panel. These settings control Monitor's operational behavior beyond individual threat rules.

Click to expand

See Advanced Configuration for the full reference of all settings.

Next Steps