Custom tests let you monitor your environment using your own logic, so compliance checks reflect how your organization actually operates. You can create, review, and publish custom tests from the Monitoring page, then map them to controls once they're ready.

Once published, custom tests run automatically and generate audit-visible evidence.

Before creating a custom test, it's helpful to think through the decisions below. While you don't need to follow this order exactly when creating the test, making these decisions ahead of time can make building the test easier and more predictable.

This is the most important concept to understand when building custom tests. A condition group defines:

Use multiple condition groups when:

Example: One condition group evaluates S3 buckets. Another condition group evaluates EBS volumes.

Available resources depend on:

Once a resource is used for a service, that service will no longer appear when adding another condition group.

⚠️ If you change the selected service or resource after configuring conditions, the test may reset and require reconfiguration.

Each condition includes:

Use multiple conditions when:

Example:

Filtering criteria narrow the scope of a condition group before conditions are evaluated. Use filtering criteria when:

Example: Evaluate all S3 buckets except those tagged with DrataExclude.

Use the Advanced editor to write complex queries instead of selecting attributes, operators, and values manually.

The Advanced editor supports:

This is recommended for users familiar with structured data and JSON-like logic.

While building a custom test, select the info icon to open the Resource Guide and explore available services, resources, and their attributes.

After saving, the test is created as a draft.

This allows you to validate logic safely. Draft test runs are logged as Autopilot Draft Test events.

When ready:

After publishing:

ℹ️ Test logic and exclusions carry over; draft history and notes do not.

Learn how to create, publish, and edit custom tests. You can create your own tests on the Monitoring page to leverage the data Drata pulls from your systems to monitor your organization's needs. View the Role Administration & RBAC article to learn who has access to the Monitoring page.

Note: All custom published or draft tests are run by Autopilot daily.

To create custom tests, go to your Monitoring page and select Create test. Enter the test details and continue. The test name and description are included in the daily generated evidence that auditors have access to.

Test names must be unique within your account.

After continuing, a draft of your test is created, and you are redirected to the Test Builder page.

On the Test Builder page, you can configure the details of the test and access additional resources before publishing it. You can create your custom test on either the Builder tab or Advanced editor tab. In general, the main sections on the Test Builder page are Logic details and Condition Group.

To understand the types of data each resource contains, you can utilize our Resource Guide. For more information about the Resource Guide, go to Resource Guide for custom tests.

For the logic details section, select the evaluation threshold.

Select a provider and accounts to move on to the next steps.

For each condition group, select a resource you want your test to evaluate.

The available resources depend on what provider was selected in the previous section, Logic details, and what service was selected under the Condition Group section.

After selecting a resource, you can configure the conditions and add additional filtering criteria.

You can add multiple condition groups, filtering criteria, and conditions.

For certain resources, Drata also pulls in the tags or labels. You can use these attributes in your conditions or as a filtering criteria. Select the attribute depending on the provider you selected.

Now, you can select the operator. After selecting the operator, you can enter the key name that is associated with the tag or label. For example, in the following image, we configured a test for a Buckets resource in AWS to verify if Encryption exists on all buckets, but we want to exclude all the buckets that contain a tag with key "{your key name}".

Note: Custom tag properties only evaluate the information in the key, not the value.

Another example is when you have tagged certain resources with DrataExclude so that you can filter those resources out on your existing Drata tests, you can include DrataExclude in the value so that you exclude those resources out as well.

After you set your configurations, save the draft and continue. You will be redirected to that test drawer. The test is still a draft test.

Once a test is in draft mode, an initiation of an autopilot run so that you can view the results of your draft test. The test runs are logged on the Event Tracking page as Autopilot Draft Test types.

To view your draft tests:

The test details drawer has the following sections:

After the test runs, your test result might have failed. You can include or exclude resources that might have failed your test. Select the resources to exclude and then submit your reasons.

An excluding tab will appear next to the included tab that shows all of the excluded resources.

To publish the test, select publish test. When you publish your test, the test history and internal notes will not carry over. The test logic and exclusions will carry over.

After publishing the test, the test name will not have the draft indicator. With the published test, you can create tickets under the Ticket management section and map controls under Control info.

A PDF is downloaded and contains information about your custom test including exclusions of resources, the reason for exclusion, test logic in JSON format, and the raw JSON response for the test.

To edit your custom test, go to Edit a Custom Test.