diff --git a/chapter7/rules/host_cpu.esql b/chapter7/rules/host_cpu.esql
new file mode 100644
index 0000000..b5eb82e
--- /dev/null
+++ b/chapter7/rules/host_cpu.esql
@@ -0,0 +1,3 @@
+FROM metrics-system.cpu-*
+| STATS AVG(host.cpu.usage) BY host.name
+| WHERE `AVG(host.cpu.usage)` > 0.8
diff --git a/chapter7/rules/host_memory.esql b/chapter7/rules/host_memory.esql
new file mode 100644
index 0000000..487cd32
--- /dev/null
+++ b/chapter7/rules/host_memory.esql
@@ -0,0 +1,3 @@
+FROM metrics-system.memory-*
+| STATS AVG(system.memory.used.pct) BY host.name
+| WHERE `AVG(system.memory.used.pct)` > 0.8
diff --git a/chapter7/rules/k8s_pod_cpu.esql b/chapter7/rules/k8s_pod_cpu.esql
new file mode 100644
index 0000000..3cc5765
--- /dev/null
+++ b/chapter7/rules/k8s_pod_cpu.esql
@@ -0,0 +1,3 @@
+FROM metrics-kubernetes.pod-*
+| STATS AVG(kubernetes.pod.cpu.usage.node.pct) BY kubernetes.pod.name
+| WHERE `AVG(kubernetes.pod.cpu.usage.node.pct)` > 0.8
diff --git a/chapter7/rules/k8s_pod_memory.esql b/chapter7/rules/k8s_pod_memory.esql
new file mode 100644
index 0000000..7077760
--- /dev/null
+++ b/chapter7/rules/k8s_pod_memory.esql
@@ -0,0 +1,3 @@
+FROM metrics-kubernetes.pod-*
+| STATS AVG(kubernetes.pod.memory.usage.limit.pct) BY kubernetes.pod.name
+| WHERE `AVG(kubernetes.pod.memory.usage.limit.pct)` > 0.8