Create a SubImage custom rule

Help an operator author and persist a new SubImage custom security rule end-to-end from chat. The skill ends when the rule is saved and the user knows when to expect findings.

The deliverable is one successful subimageCreateCustomRule call. Findings are produced on the next scheduled findings build, not inline.

What this does

A SubImage custom rule is a tenant-local Cartography rule. It contains:

• one or more Facts, each with a Cypher detection query (cypher_query) plus a graph-visualization query (cypher_visual_query),
• an output_fields list describing every column the detection query returns,
• optional references (CIS controls, vendor advisories, etc.),
• tags for categorization.

When to use