Device rules
After 2026-10-R1, device rules tag, color, sort, and collect devices into views, and raise alerts, on the server.
Devices which match at least one rule carry kismet.device.base.rules:
| Field | Content |
|---|---|
kismet.device.rules.matched | Names of the rules the device matches |
kismet.device.rules.tags | Tags from the matching rules |
kismet.device.rules.color | Highlight color from the first matching rule with a color |
Each rule with a view makes a device view named rule-<name>, and device views can be ordered with a sort by passing rule_sort.
Rules set over the API come after the rules from the Kismet config, and replace only the rules set earlier over the API.
Device rules
The device rules and sorts currently loaded, in order, and how they are evaluated.
| Field | Content |
|---|---|
kismet.devicerules.backend | jit when rules are compiled to native code, vm when they run in the bytecode interpreter, or none |
kismet.devicerules.jit_error | Why the rules aren’t using the JIT, when they aren’t |
kismet.devicerules.rules | The rules: kismet.devicerules.rule.name, .source (the rule text), .tags, .color, .view (the rule-<name> view, when the rule has one), .alert, .live, and .origin (the file and line the rule came from) |
kismet.devicerules.sorts | The sorts: kismet.devicerules.sort.name, .source, and .origin |
kismet.devicerules.api_rules | The rules text last set with set.cmd |
kismet.devicerules.api_save | Rules set with set.cmd are saved and loaded at startup (device_rules_api_save) |
kismet.devicerules.passes | Rule checks run so far |
kismet.devicerules.evaluated | Devices checked by those passes |
kismet.devicerules.last_pass_us | Duration of the last pass, in microseconds |
readonly/devices/rules/rules.json/devices/rules/rules.ekjson/devices/rules/rules.prettyjsonGET
POSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
fields
field simplification
OPTIONALKismet can reduce the amount of information being processed and returned by an API by simplifying the fields to only return the data needed by the caller.
You can read more about the field simplification API and how to use it here.
Check rules
set.cmd would load them: after the
configured rules, replacing the rules set earlier over the API.admin/devices/rules/check.cmdPOSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
rules
string
REQUIREDRules and sorts, in the device rules language; at most 256KB.
Rules set over the API can’t include other files.
On success, {"ok": true, "backend": "jit" or "vm", "rules": [names], "sorts": [names], "replaced": [...]},
where replaced lists configured rules and sorts which these rules replace by name.
On an error in the rules, {"ok": false, "error": "...", "line": N, "col": N}.
Set rules
Replace the rules set over the API. They come after the rules from the Kismet config and replace only the rules set earlier over the API; a rule with the same name as a configured rule replaces it.
If any rule has an error, nothing changes. When device_rules_api_save=true, the rules are written
to device_rules_api_file and loaded again at startup. Rules which would make more than 256 views
in all are an error.
Devices are checked against the new rules on the next pass, and join or leave rule views and raise alerts as they start or stop matching.
admin/devices/rules/set.cmdPOSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
rules
string
REQUIREDRules and sorts, in the device rules language; at most 256KB. An empty string removes the rules set over the API.
On success, {"ok": true, "rules": N, "sorts": N, "backend": "jit" or "vm", "replaced": [...], "saved": true or false},
with save_error when saving the rules failed.
On an error in the rules, {"ok": false, "error": "...", "line": N, "col": N}.
Test rules on a device
admin/devices/rules/test.cmdPOSTPARAMETERS
This endpoint takes additional parameters by using a `POST` request and supplying a
JSON document or json form variable.
You can find more information about API parameters here.
rules
string
REQUIREDRules to test, in the device rules language. Only these rules are tested, without the configured rules.
device
string
REQUIREDDevice key
On success, {"ok": true, "matches": {"rule name": true or false, ...}}.
On an error in the rules, {"ok": false, "error": "...", "line": N, "col": N}.