Multistage rule workflow

The following steps describe the general workflow of a multistage rule. For details on creating multistage rules, see Creating a multistage rule.

Create a first-stage rule. This rule must have at least one assertion. First-stage rules can generate alerts.
First-stage rules add detect_* tags to events as Helix Enterprise processes the raw events sent to it. The detect_* tags are:
- detect_ruleids
- detect_rulenames
- detect_rulematches
You can use these tags to search for events that match rules, without the need to generate alerts for every rule.
Optionally, create middle-stage rules. These rules must include at least one assertion and at least one dependency. Middle-stage rules cannot be alerted on and do not add detect_* tags to events.
Create a final-stage rule. The final-stage rule must have at least one dependency, but no assertions. The final-stage rule cannot be alerted on and does not add detect_* tags to events.
When the multistage rule is satisfied, a class=analytics application='multi-stage rules' event is created.
If you want to generate alerts for the multistage rule, you must create another rule that matches on this analytics event. For example, if the final-stage rule has a rule ID of 9999.0.1, the query for the alerting multistage rule would be:
```
class=analytics application='multi-stage rules' detect_ruleids:9999.0.1
```