Rules define what a policy should do in response to a specific type
of event. Each rule consists of a condition
and an action.
The condition is the part of an event policy that describes the
type of event in the source that will trigger an action and the
action is the response that the policy should take if an event that
matches the condition occurs. A policy must contain at least one
rule. If the policy contains multiple rules, it is important to
remember that the rules are evaluated in a specific order, and that
when one condition is matched, no additional rules will be
evaluated.