QRadar rules Custom rules perform tests on events, flows, and offenses to detect unusual activity in your network. Anomaly detection rules perform tests on the results of saved flow or event searches to detect when unusual traffic patterns occur in your network.