Create rules to detect specific content in the log records. You can do this by creating a detection rule based on a label which is associated with the log records from specific log sources and entity types. Use this feature to identify anomalies at ingest time. See Detect Predefined Events at Ingest Time.