---
module: incident.processing-rules
title: Processing Rules
tab: Customer
order: 10
audience: customer
---

Processing Rules decide what HiveIQ does when your devices report events — whether an event becomes an incident, gets ignored, or automatically closes one. Use this screen to cut down on noise and tailor incident handling to your fleet.

The screen has three tabs: **Opening Rules**, **Closing Rules**, and **Event Exceptions**.

## 🟢 Opening Rules
Control how incoming device events create and manage incidents.

1. Click **+ Add Rule** to create a rule.
2. Give it a **name**, pick the **event type** it applies to, and choose an **action**:
   - **Create Incident** — raise an incident, optionally with an override severity or incident type.
   - **Suppress** — ignore matching events so they never become incidents.
   - **Open & Close** — record the incident but close it immediately, so it shows in reports without cluttering the active board.
3. Optionally add a **Text Pattern** so the rule only fires when the event details contain that text.
4. Scope the rule to one **institution**, or leave it **Global** to apply fleet-wide.
5. Save. Use the **Enabled / Disabled** toggle any time to turn a rule on or off.

> Each rule row can be **Edited**, viewed with **History** (a full change log), or **Deleted**. Filter the list by keyword, device type (ATM or TCR), or action using the left sidebar.

## ✨ Suggest a Rule (Adoons)
Not sure how to write a rule? Let Adoons help.

1. Click **✦ Suggest a Rule**.
2. Paste a sample log line, describe what you want to catch, or both.
3. Click **Get Suggestion** — Adoons proposes a rule with a confidence score and its reasoning.
4. Choose **Publish Directly**, **Save as Draft** for later review, or **Edit First** before saving.

> Saved drafts appear under **Pending Drafts**, where you can **Approve**, **Edit**, or **Reject** each one before it goes live.

## 🔴 Closing Rules
Automatically resolve or close open incidents when a matching recovery event arrives — for example, closing a "card reader failed" incident once the reader recovers. Add, edit, and enable these rules the same way as opening rules.

## ⚠️ Event Exceptions
Shows events received with event types HiveIQ doesn't yet recognise, grouped by type with how often and on how many devices they occurred. Review them to create a matching rule or add a new event type, and **Dismiss** ones you don't need.

## What you're looking at
- **Action** — what the rule does: Create Incident, Suppress, or Open & Close.
- **Override Severity** — the severity applied when an incident is created (blank means the default is used).
- **Institution** — the institution the rule is scoped to, or **Global** for the whole fleet.
- **Status** — whether the rule is currently Enabled or Disabled.

> Good to know: institution-scoped rules take priority over global ones, and if no rule matches an event, HiveIQ falls back to its built-in default behaviour.
