Data Rules: How to Filter and Monitor the Right Data
Data Rules let you control which data Thoropass monitors from an integration. This helps you reduce noise, focus on what’s in-scope for your audit, and ensure Thoropass is collecting the most relevant evidence.
What are Data Rules?
A Data Rule is a filter you configure for an integration so Thoropass only pulls in (or evaluates) data that matches what your organization cares about.
For example, Data Rules can help you:
Monitor only production AWS accounts (not dev/sandbox)
Include only assets tagged with
env=prodExclude resources owned by a specific team
Narrow results to only what’s in your audit scope
Why use Data Rules?
Without Data Rules, integrations can return a huge amount of data, including resources that aren’t relevant for compliance or audit scope.
Data Rules help you:
Reduce alert noise
Improve monitor accuracy
Stay tightly aligned to audit scope
Speed up evidence collection and reviews
Avoid chasing false positives
When should you configure Data Rules?
You should configure your account to use Data Rules if:
Your company has multiple environments (dev / staging / prod)
You have many accounts, subscriptions, or projects (AWS / Azure / GCP)
You have many teams and only want to monitor in-scope resources
You want Thoropass results to match how your auditor expects you to define scope
Best practices for Data Rules
Keep rules aligned with audit scope
If your audit scope says “production systems only,” your Data Rules should reflect that.
Use tags whenever possible
Tag-based rules are typically the easiest to maintain long-term (especially in cloud environments).
Start simple
Begin with a small rule (like including only prod), verify results, then expand as needed.
Avoid overly strict rules
If your Data Rules are too narrow, Thoropass may miss important assets or evidence.
Need help?
If you’re unsure what rules to set up, reach out to Thoropass Support (or your CSM). We can help you configure Data Rules based on your audit scope and integration setup.