Detection System

TrueAudit's Detection System allows you to schedule daily scans for suspicious or unusual activity and get alerted when certain audit events pass configured thresholds. Perfect for monitoring large-scale deletions, role changes, bans, and more.

---

/setdetection <channel> <hour> <minute>

Set when and where your server’s daily detection scans should run.

• channel — The channel to send alerts to

• hour — Hour of the day (0–23) based on your server's timezone

• minute — Minute of the hour (0–59) 🔒 Permissions Required: Administrator & Manage Server

✅ Once configured, TrueAudit will perform a scan every day at the time you choose and post alerts to the selected channel.

---

/setdetectionrule <event_type> <level> [role]

Create a new detection rule for a specific audit event.

• event_type — Type of action to monitor (e.g. message delete, role update)

• level — Sensitivity threshold (low, medium, or high)

• role (optional) — Role to mention when this rule triggers 🔒 Permissions Required: Administrator & Manage Server 🧠 Includes autocomplete for event names and level selection.

✅ Example:

/setdetectionrule message_delete high @Moderators

---

/removerule <rule_id>

Remove an existing detection rule using its ID.

• rule_id — Found in /detectionrules 🔒 Permissions Required: Administrator & Manage Server

---

/detectionrules

View all configured detection rules for your server.

Each rule shows:

• Rule ID

• Event being monitored

• Threshold level

• Role that will be pinged (if any)

---

⏱️ How Detection Works (Behind the Scenes)

Every minute, TrueAudit checks whether any servers are scheduled to run a detection scan at that moment based on their configured time and timezone.

If a scan is due:

• It looks through the past 24 hours of logged audit events

• Compares activity counts against the thresholds set for each event type (low, medium, high)

• If a threshold is crossed:

  • It sends a clean, detailed embed listing which events were triggered

  • It optionally pings any roles attached to the triggered rules

This system runs entirely in the background and is optimized for performance. You’ll only be notified if something meaningful happened — no noise, just signal.

---

📋 Example Alert

📈 Daily Audit Detection Here are notable event spikes in the last 24h:

🔔 Message Delete — 79 in the past 24h  
🔔 Role Update — 42 in the past 24h

@ModAlerts A detection rule was triggered for this event. Check your settings or respond if needed.

---

🧠 Why Use Detection?

• Catch mass events (like someone deleting lots of messages or banning multiple users)

• Proactively detect issues before they're reported

• Add an early warning system to your moderation toolkit

• Reduce the need to constantly check audit logs manually

With customizable thresholds and alerts, you’ll always know when something serious is happening — even if you’re not online.