> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro-rules/creating-rules.md).

# Create and validate a rule

Connect one passive trigger to one active action in the Rules editor.

## Prepare the profiles

Create or import an enabled passive trigger and an enabled active action. This tutorial uses the downloadable examples:

* [Example\_Debug\_Query\_Parameter](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/profiles/passive-request.bb): detects a query parameter named `debug`.
* [Example\_Marker\_Reflection](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/profiles/active-reflection.bb): appends a marker to query values and reports body reflection.

The trigger identifies a request. It does not by itself promise that the action will mutate only that parameter. Active profiles retain their own insertion-point behavior.

## Use the Rules editor

1. Open **Rules → Add** and enter a unique name and comments.
2. Add an enabled Match row. Leave the first operator empty, choose **Passive Request**, then the exact trigger profile name.
3. Add an enabled Execute row. Choose **Profile**, then the exact active name.
4. Choose **All Matches** for a transparent test run with a small input batch.
5. Save and confirm the rule is enabled. Saving through the editor enables the rule; disable it again if it is a draft.
6. Launch **Local Scanner → Smart Scan** on an exchange containing `?debug=1`.
7. Inspect Scanners → Smart for the trigger/action and Scanners → Active for the actual probes.

## Exported example

```json
[
  {
    "enabled": true,
    "name": "Example_Debug_To_Reflection",
    "comments": "When a debug query parameter is observed, run the reflection example.",
    "match": ["true,,Passive Request,Example_Debug_Query_Parameter"],
    "execute": ["true,Profile,Example_Marker_Reflection,All Matches"]
  }
]
```

Download [rule\_Example\_Debug\_To\_Reflection.bb](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/examples/rules/rule_Example_Debug_To_Reflection.bb). Put it in the **rules** directory, with its referenced profiles in **profiles**, then reload Pro. Do not send the rule to Server as a scan profile.

## Check both directions

Use a request without `debug` and confirm it does not trigger this rule. Use `?other=debug` to check that a value is not mistaken for a name. Verify the target profile is still enabled and that its final requests are appropriate for the assessment.

For a tag action, inspect every enabled active profile with that tag. Adding a new profile to a tag can broaden an existing rule without changing the rule file.

## Import, maintenance and dependencies

Keep exact referenced names stable. Renaming/deleting a profile can leave a rule pointing at nothing. Conditions use the exact profile name and passive type; shared issue titles do not merge distinct triggers.

Back up/export before editing, keep drafts disabled, and inspect the saved file after changes. For portable external editing, avoid commas in names/tags used in rule rows. Use [the format reference](/burp-bounty-pro-rules/reference.md) rather than inventing a new condition schema.