> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro-rules/overview.md).

# Overview

Turn passive observations into focused active checks with Smart Scan.

Rules connect a passive observation to active checks in **Smart Scan**. For example: detect a query parameter of interest, then run a selected active profile against the corresponding request.

Rules belong to the Pro extension. Burp Bounty Server executes profiles supplied through REST/MCP; it does not load or evaluate Pro rule files.

## A small automation, step by step

```mermaid
flowchart LR
    exchange["Captured exchange"] --> passive["Passive profile matches"]
    passive --> rule["Smart Scan rule"]
    rule --> active["Selected active checks"]
    active --> review["Review findings"]
```

## Components

| Component                     | Purpose                                                                                    |
| ----------------------------- | ------------------------------------------------------------------------------------------ |
| Name, enabled state, comments | Identify and explain the automation.                                                       |
| Match rows                    | Refer to passive request or response profiles.                                             |
| Execute rows                  | Refer to active profiles or tags.                                                          |
| Action scope                  | All Matches per exchange, or First Match per rule/action/origin in this extension session. |

## Actual file format

Rules are JSON arrays saved as **`rule_<name>.bb`** in `BurpBountyData/rules`. They use lowercase fields such as `name`, `enabled`, `match`, `execute`. They are not the `ProfileName`/`Scanner` schema for scan profiles.

Older documentation showed `.bbre` files and `Conditions`/`Actions` objects. That example did not match the current serializer. Use [the current format](/burp-bounty-pro-rules/reference.md) and export a rule from Pro when building integrations.

## Start with one trigger and one action

Enable the referenced passive profile, the rule and the active profile. Run a narrow manual Smart Scan, verify the trigger, then inspect the launched active requests. Expand to live scanning only after confirming the behavior.

{% hint style="info" %}
**Combine evidence deliberately**

`And` requires all enabled conditions in the same exchange. `First Match` prevents duplicate action submissions for the same rule/action/origin during the current extension session. Read [rule semantics](/burp-bounty-pro-rules/reference.md) for grouping, retries and reset behavior.
{% endhint %}

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Create your first rule</strong></td><td>Connect one passive trigger to one active action.</td><td><a href="/burp-bounty-pro-rules/creating-rules.md">Create and validate a rule</a></td></tr><tr><td><strong>Explore examples</strong></td><td>See common automation patterns and their limits.</td><td><a href="/burp-bounty-pro-rules/examples.md">Examples</a></td></tr></tbody></table>