create-custom-rule

To create custom security rules, you provide a plain-English rule intent and select a provider module. The Skill drafts a tenant-local SubImage custom Cypher rule, validates read-only syntax with aliased outputs, and saves it for the next findings build.

Yes, you can write custom Cypher detection queries for missing coverage. The Skill enforces SubImage's rule constraints by validating explicit aliases, valid output fields, and safe read-only syntax before submitting the custom finding definition.

You validate and save a custom Cypher rule by confirming naming collisions and verifying queries against the live tenant graph. The Skill handles end-to-end submission, ensuring the rule persists with facts, tags, references, and clear finding intent.

Custom Cartography security detections in SubImage support AWS, GCP, Azure, GitHub, and Kubernetes providers. You select the appropriate provider module during rule authoring to target the specific cloud or infrastructure environment.

Custom Cypher rules for security detections require explicit rule intent, provider module selection, validated read-only syntax, and aliased outputs. Rules that do not meet SubImage's constraints or fail graph visualization query verification cannot be submitted.

You do not need to manually write Cypher from scratch to detect cloud misconfigurations. You provide a plain-English security concern, and the Skill drafts the custom finding definition, validates the query, and registers the tenant-local rule.