Add rule enhancements

[jeff-matthews]

Summary by CodeRabbit

• Documentation
  • Updated Privilege Zones docs to use the new Enterprise logo pill styling in place of the old badge in several places.
  • Added clearer guidance for creating, editing, and troubleshooting rules, including what happens when switching rule types, rerunning Cypher queries, and saving changes.
  • Clarified certification and validation behavior, including when updated zone or label membership becomes visible after analysis.

Staging

https://specterops-pz-rule-enhancements.mintlify.site/analyze-data/privilege-zones/rules

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e8557257-7b91-4105-87f4-eace1946d538

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Documentation-only updates to Privilege Zones pages. Enterprise Edition badge components are replaced with styled SVG pill images in labels, zones, and overview docs. Rules documentation is expanded with reformatted and new Note/Tip/Warning callouts covering rule type switching, Cypher query validation, edit/delete permissions, and troubleshooting guidance.

Changes

Enterprise badge visual replacement

Layer / File(s)	Summary
Badge to SVG pill swap docs/analyze-data/privilege-zones/labels.mdx, docs/analyze-data/privilege-zones/zones.mdx, docs/analyze-data/privilege-zones/overview.mdx	Enterprise Edition Badge components are replaced with styled enterprise SVG <img> pills in labels' and zones' Create/Delete sections, and removed entirely from overview's Certification concept row.

Rules editing and validation guidance

Layer / File(s)	Summary
Rule intro and expansion callouts docs/analyze-data/privilege-zones/rules.mdx	Single-line Note/Tip callouts are reformatted to multi-line blocks in intro, expansion, and Zone Builder sections; a new Warning about reviewing rule expansion is added before the configuration table.
Rule type switching and Cypher validation flow docs/analyze-data/privilege-zones/rules.mdx, docs/analyze-data/privilege-zones/overview.mdx	New guidance describes Object ID/Cypher state preservation when switching rule types, requiring re-running Cypher queries before saving, and the two-stage validation (editor validation, then post-save analysis) referenced in overview.
Edit/delete rule permissions and troubleshooting docs/analyze-data/privilege-zones/rules.mdx	Permission notes are added for editing and deleting rules, Cypher save/confirmation behavior is detailed for edits, and troubleshooting subsections cover unsaved rule-type changes, failed Cypher saves, and the updated "Object deleted from graph" pill styling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• slokie-so

A rabbit hops through docs so bright,
Swapping badges for pills of light. 🐰✨
Cypher rules now clearly explained,
Every edge case neatly contained.
Hop, hop—the docs are refined tonight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main theme of rule-related documentation enhancements in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pz-rule-enhancements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jeff-matthews]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[jeff-matthews]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (1)

docs/analyze-data/privilege-zones/rules.mdx (1)

260-262: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

New troubleshooting subsections don't match the "missing objects" framing.

The section intro (line 262) frames this heading around "If a rule doesn't show expected objects or appears empty, consider the following common causes", but "Unsaved rule type changes disappeared" (278-282) is about losing unsaved UI edits when navigating away, not about missing graph objects. "Cypher changes do not save" (284-290) is also primarily a save/validation UX issue rather than an object-visibility issue. A reader searching for "why don't I see expected objects" is unlikely to find or need these two subsections here.

Consider either renaming the parent heading/intro to broaden its scope (e.g., "Troubleshoot rules"), or moving these two subsections under "Define a rule"/"Edit a rule" as standalone guidance rather than nesting them in the missing-objects troubleshooting flow.

Also applies to: 278-291

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/analyze-data/privilege-zones/rules.mdx` around lines 260 - 262, The
“Troubleshoot missing objects” section is too narrow for the added “Unsaved rule
type changes disappeared” and “Cypher changes do not save” subsections. Update
the surrounding structure in the rules.mdx content by either broadening the
parent heading/intro in the Troubleshoot missing objects section to cover
general rule-editing issues, or moving those two subsections into the Define a
rule/Edit a rule guidance so they no longer sit under the missing-objects flow.
Use the existing subsection titles as anchors when relocating or retitling this
content.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/analyze-data/privilege-zones/rules.mdx`:
- Around line 260-262: The “Troubleshoot missing objects” section is too narrow
for the added “Unsaved rule type changes disappeared” and “Cypher changes do not
save” subsections. Update the surrounding structure in the rules.mdx content by
either broadening the parent heading/intro in the Troubleshoot missing objects
section to cover general rule-editing issues, or moving those two subsections
into the Define a rule/Edit a rule guidance so they no longer sit under the
missing-objects flow. Use the existing subsection titles as anchors when
relocating or retitling this content.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 82161fef-e2f4-4b82-962e-6a57a72616e5

📥 Commits

Reviewing files that changed from the base of the PR and between 9cca09f and 94a7a29.

📒 Files selected for processing (4)

• docs/analyze-data/privilege-zones/labels.mdx
• docs/analyze-data/privilege-zones/overview.mdx
• docs/analyze-data/privilege-zones/rules.mdx
• docs/analyze-data/privilege-zones/zones.mdx

[rtippitt-specterops]

Solid! Have I mentioned how much I appreciate you building these for us? Thank you