Create activity rules with the investigation tool

This feature is available with G Suite Enterprise, G Suite Enterprise for Education, Drive Enterprise, and Cloud Identity Premium editions.

To help prevent, detect, and remediate security issues more quickly and efficiently, you can automate actions in the investigation tool by creating activity rules.

As an administrator, you can create an activity rule that alerts you or takes action based on any search that you configure in the investigation tool. After you configure the activity rule, Google will continuously perform a search that you have specified in the rule. If the number of results returned by that search exceeds the threshold that you have set up, then Google will perform the actions that you specify. For example, you can set up a rule to send email notifications to certain administrators if Drive documents are shared outside the company.

Important:

The creation of activity rules is limited by the following factors:

  • You can only create rules on log data sources.
  • You must add an event attribute to the query.
  • You must base the query on an AND condition at the top level (not OR).
  • You can't use date filters for activity rules (since the rules are evaluated continuously).
  • You must add at least one action or alert to the rule.

Because activity rules are based on log events, they trigger after the event happens. Therefore, activity rules aren't suitable for things like blocking or sharing a document or sending emails.

Privileges for creating rules in the investigation tool

  • To create and edit rules for a specific data source (for example, Gmail or Drive) you need the manage rules privilege and the update and delete privilege for that data source.
  • To view rules for a specific data source (for example, Gmail or Drive), you need the view rules privilege and the view metadata and attributes privilege for that data source.

Create a rule from a search in the investigation tool

  1. Sign in to the Google Admin console at admin.google.com.
    Be sure to sign in using your administrator account, and not your personal Gmail account.
  2. At the top, click Menu Menu and select Security > Investigation tool. 
  3. Choose a data source for your search; for example, Device log events, Drive log events, or Gmail log events.

    Note: Available data sources will vary depending on your G Suite edition.

  4. Click ADD CONDITION.
    You can include one or more conditions in your search. For details about conditions that are available for each data source, see Customize searches with the investigation tool. 
  5. From the More menu in the upper-right, select Create rule.
  6. Type a Rule name—for example, External data sharing—and type a Rule description—for example, Notify if documents are shared outside the company.
  7. Click NEXT: VIEW CONDITIONS.
    You can view the search that you configured earlier, or you can continue making changes to your search. You can also click SEARCH to get a preview of your search results before continuing with the process of creating your rule. 
  8. Click NEXT: ADD ACTIONS.
  9. Define a time period and a threshold for the rule. For example, you can configure a threshold of Every 24 hours when the count is greater than 100. This means for any given period of 24 hours, if your search returns more than 100 results, you want this rule to trigger. 
  10. Choose whether or not you want this rule to trigger an alert in the alert center.
    If you choose to turn on alerts for this rule, you can choose a severity of High, Medium, or Low. You can also choose to send email notifications by checking the All super administrators box, and/or by clicking ADD RECIPIENTS to send emails to select administrators when the rule is triggered.
  11. Click NEXT: REVIEW.
    Use this page to review all of the details of the rule and to make any changes, if needed, before creating the rule.
  12. Review the Rule status. 
    When creating an activity rule, the rule status is Active by default, which means the system will begin collecting logs, and the rule will be enforced. You also have the option to set the rule status to Monitor, which enables you review logs before enforcing the rule. Later, you can also set the rule to Inactive, which means the system is no longer collecting logs, and the rule isn't enforced. 
  13. Click CREATE RULE.

View the list of rules and rule details

After you have created a rule using the investigation tool, you’re directed to the Rule details page, where you can review the rule’s details and scope, the conditions for the rule, and the actions that are triggered when thresholds are met. 

The Rule details page also includes breadcrumbs in the upper-left corner:
Security > Rules > Rule details

Click Rules to see a list of all rules that have been created by all administrators in your domain. 

From the Rules page, administrators within your domain are able to view rules created by other administrators, depending on the data source for the rule and the privileges of each administrator. For example, an administrator might have view privileges for Drive log events, but not for Gmail log events, and therefore they’re unable to view any rules that are based on Gmail log events.

You can use the Rules page to take the following actions:

  • Delete rules.
  • Filter the list of rules by clicking Add a filter. 
  • Click ADD NEW RULE to create new rules. This takes you through the same process described above, which enables you to create a rule based on a search in the investigation tool.

Email alerts

If you set up email notifications for your rule, emails are sent to specified recipients when the rule is triggered. The email notification contains a summary of the rule that triggered the alert, including the rule name, the threshold details, source data, and more. Administrators who receive the email notification can click VIEW ALERT to be taken to the Alert details page in the alert center.

Was this helpful?
How can we improve it?