> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/detections/lookout-rules.md). # Lookout Rules Lookout rules are specific vendor alerts, or signal, that the SOC analysts flag for a closer look in your environment. Lookout rules may not be a threat, but they certainly need to be evaluated. For example, SOC analysts can create lookout rules for specific users in your environment who could be targets because of recent press coverage. {% hint style="info" %} Like [suppression rules](/workbench-reference/detections/suppression-rules.md), lookout rules are created by SOC analysts both for your specific environment and for all customers. {% endhint %} The following is a list of lookout rules:

Rule	Action
Always Expel alert	If a vendor alert matches this rule, Ruxie generates a new Expel alert.
Add to	If a vendor alert matches this rule, Ruxie adds an Expel Alert to an existing investigation or incident.
Always Expel alert & add to	If a vendor alert matches this rule, Ruxie generates a new Expel alert and adds that new Expel alert to an existing investigation or incident.

Lookouts will also have one of two statuses:

Status	Color	Meaning
Active	Green	The lookout is active for your environment.
Expired	Gray	The lookout is inactive for your environment.

You can view lookout rules by going to **Detections > Lookouts**. Along the top of this screen, you can also use the various lists to sort the results. {% hint style="warning" %} You can only view the lookout rules; you cannot edit or change any of them. If you see a lookout rule you have a question about, disagree with, or want removed, select **Copy link to rule** and paste it into a message for our [Support team](/support/how-to-reach-us.md). {% endhint %}

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-reference/detections/lookout-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.