Lists and Macros are reusable components defined at the file level (before rules) that can be used by multiple rules in the same file.
Important: lists and macros are NOT fields within a rule. They are separate components defined at the file level, before your rules. This allows them to be reused by multiple rules in the same file.
Lists
Lists are reusable address/value collections. Define them once at the top of your file, then reference them in any rule’s condition using the in operator:
- list: known_dex_routers
items:
- "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D" # Uniswap V2
- "0xE592427A0AEce92De3Edee1F18E0157C05861564" # Uniswap V3
- "0xd9e1cE17f2641f24aE83637ab66a2cca9C378B9F" # SushiSwap
- rule: DEX Interaction
desc: Detects interactions with known DEX routers
tags: ["defi", "dex"]
condition: tx.to in (known_dex_routers)
output: "DEX interaction detected: %tx.to"
priority: NOTICE
enabled: true
Macros
Macros are reusable condition fragments. Define them once at the top of your file, then reference them in any rule’s condition:
- macro: high_value_transfer
condition: tx.value > 100 ether
- macro: is_dex_interaction
condition: tx.to in (known_dex_routers)
- rule: High Value DEX Swap
desc: Detects high-value swaps on DEX routers
tags: ["defi", "dex", "high-value"]
condition: >
high_value_transfer and
is_dex_interaction
output: >
High value DEX swap: %tx.value_eth ETH on %tx.to
priority: WARNING
enabled: true
Complete Example
# 1. Define lists and macros first
- list: known_dex_routers
items:
- "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D"
- "0xE592427A0AEce92De3Edee1F18E0157C05861564"
- list: monitored_addresses
items:
- "0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb"
- macro: high_value_transfer
condition: tx.value > 100 ether
- macro: is_dex_interaction
condition: tx.to in (known_dex_routers)
# 2. Define rules that use the components above
- rule: High Value DEX Swap
desc: Detects high-value swaps on DEX routers
tags: ["defi", "dex", "high-value"]
condition: >
high_value_transfer and
is_dex_interaction
output: >
High value DEX swap: %tx.value_eth ETH on %tx.to
priority: WARNING
enabled: true
- rule: Monitored Address Transfer
desc: Detects transfers to monitored addresses
tags: ["security", "monitoring"]
condition: >
tx.to in (monitored_addresses) and
tx.value > 10 ether
output: >
Transfer to monitored address: %tx.value_eth ETH to %tx.to
priority: WARNING
enabled: true
How It Works
- Lists and Macros are defined outside of rules (at the file level), but in the same file as your rules
- They must be defined before the rules that use them
- Macros are expanded when rules are evaluated, allowing you to reuse condition logic
- Lists used with the
in operator are resolved at evaluation time
- Multiple rules in the same file can reference the same list or macro
When to Use Lists vs Macros
- Use Lists for collections of addresses or values that you want to check membership (
in operator)
- Use Macros for reusable condition fragments that you want to reference by name
Next Steps
