diff --git a/config/rules.json b/config/rules.json
new file mode 100644
index 0000000..28ed574
--- /dev/null
+++ b/config/rules.json
@@ -0,0 +1,60 @@
+{
+  "schema_version": 3,
+  "network_modules": [
+    "ws2_32.dll",
+    "wininet.dll",
+    "winhttp.dll",
+    "dnsapi.dll",
+    "iphlpapi.dll"
+  ],
+  "dotnet_modules": [
+    "clr.dll",
+    "coreclr.dll",
+    "mscoree.dll",
+    "System.Management.Automation.dll"
+  ],
+  "sensitive_modules": [],
+  "module_integrity_allowlist": [
+    "ntdll.dll",
+    "kernel32.dll",
+    "kernelbase.dll",
+    "clr.dll",
+    "clrjit.dll",
+    "system.ni.dll",
+    "mscorlib.ni.dll",
+    "CallstackMonitor.dll"
+  ],
+  "alert_on_unbacked_executable": true,
+  "alert_on_backed_modified": true,
+  "dump_suspicious_regions": true,
+  "analyze_dumps": true,
+  "carve_embedded_pe": true,
+  "module_integrity_enabled": true,
+  "enable_sleep_hooks": true,
+  "enable_msgwait_hook": true,
+  "enable_wait_object_hooks": false,
+  "enable_thread_start_hooks": false,
+  "enable_threadpool_hooks": false,
+  "experimental_hooks": false,
+  "memory_api_hooks": false,
+  "unwind_integrity": true,
+  "unwind_table_hooks": false,
+  "origin_trace": false,
+  "register_trace": false,
+  "follow_remote": false,
+  "net_reset": false,
+  "etw_telemetry": false,
+  "ldr_integrity": false,
+  "dispatch_trace": false,
+  "threadpool_chain_trace": false,
+  "stack_audit": false,
+  "memory_audit": false,
+  "byoud_trace": false,
+  "shadow_stack": false,
+  "network_use_trace": false,
+  "callsite_validation": true,
+  "alert_on_unwind_tamper": true,
+  "correlation_window_ms": 5000,
+  "max_dump_bytes": 16777216,
+  "long_sleep_ms": 1000
+}