Built-in Structural Rules

15 built-in rules check the structure of the flow definition itself: overly broad addresses, dangerous port ranges, protocol misconfigurations, special addresses, and input warnings. They are independent of the compliance framework toggles. Every rule is on by default and can be disabled individually in the Rules tab.

INFO ranks below LOW: INFO advisories sort last and never raise a risk level.

Tiered severities

Source / destination breadth

The severity follows the breadth level of the address (public ranges are one level higher). A single host (/32) and any never fire the BROAD rule; any fires the ANY rule instead.

Port breadth

The port risk level (the port_risk column of the browser's CSV export) is at least as high as the worst known service inside the range (see Port & Service Database), so a range is never rated lower than a single port it contains. ICMP has no ports and never fires PORT-BROAD.

Address classification

A flag applies only when the whole address range lies inside the block. "Public" means the range is not entirely inside non-public space.

Examples:

• 10.0.0.0/7 covers 10.0.0.0 - 11.255.255.255. Part of it (11.0.0.0/8) is public, so it is public and not private and fires SRC/DST-PUBLIC.
• 224.0.0.0/3 spans multicast and reserved space. It is not public, but no single special-address rule fires.
• Any x.x.x.x/0 (for example 10.0.0.0/0) is treated as any. If the address is not 0.0.0.0, the HOSTBITS rule also fires and suggests 0.0.0.0/0.

Disabling a rule

Disabling a rule hides its advisory and removes its contribution to the per-field risk levels and the overall risk level. These levels are not shown on the on-screen result. The per-field levels appear in the browser's CSV export (src_risk, dst_risk, port_risk); the overall level appears there as overall_risk and in the CLI output as overallRisk:

Disabling built-in rules does not change the numeric risk score, which is computed from the flow itself.