Create and manage activity rules

To help prevent, detect, and remediate security issues more quickly and efficiently, you can set up alerts and automate actions in the investigation tool by creating activity rules. 

To configure a rule, you set up conditions for the rule, and specify what actions to perform when the conditions are met. A rule is simply a way of saying, if x happens, automatically do y.

As an administrator, you can create an activity rule that alerts you or takes action based on any search that you configure in the investigation tool. After you configure the activity rule, Google will continuously perform a search that you have specified in the rule. If the number of results returned by that search exceeds the threshold that you have set up, then Google will perform the actions that you specify. For example, you can set up a rule to send email notifications to certain administrators if Drive documents are shared outside the company.

Create an activity rule

You can create an activity rule either from the security investigation tool or from the Rules page. 

Follow these steps:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to Security > Investigation tool, and click Create activity rule.
   
   —OR—
   
   From the Admin console Home page, go to Rules, and then click Create rule > Activity.
    
3. Enter a Rule name—for example, External data sharing.
4. Enter a Description—for example, Notify if documents are shared outside the company.
5. Click Next: View conditions.
6. Choose a Data source for the rule—for example, Admin log events.
   
   Note: The availability of data sources varies depending on your Google Workspace edition and your admin privileges. For details, go to Admin access to reporting rules & activity rules and Data sources & conditions in the investigation tool. 
    
7. Set up one or more conditions for the rule. For each condition, choose an attribute, an operator, and a value. 
   
   For example, to set up a condition that specifies that the event is a transfer of document ownership, choose Event as the attribute, choose Is as the operator, and Doc Settings > Transfer document ownership as the value. 
   
   Note: Event is a required condition. For details about conditions that are available for each data source, see Data sources & conditions in the investigation tool.
    
8. Click Next: Add actions.
   Note: When creating an activity rule, you can't add actions for Drive log events.
9. Define a time period and a threshold for the rule. For example, you can configure a threshold of Every 24 hours when the count is greater than 100. This means for any given period of 24 hours, if your search returns more than 100 results, you want this rule to trigger. 
10. Select an Action for the rule—for example, to suspend users or force a password change.
11. Choose whether or not you want this rule to trigger an alert in the alert center.
    • Choose a severity of High, Medium, or Low.
    • If you choose to trigger an alert to the alert center, you can also choose to send email notifications by checking the All super administrators box, and/or by clicking Add email recipients to send emails to select administrators when the rule is triggered.
12. Click Next: Review.
    Use this page to review all of the details of the rule and to make any changes, if needed, before creating the rule.
13. Review the Rule status. 
    When creating an activity rule, the rule status is Active by default, which means the system will begin collecting logs, and the rule will be enforced. You also have the option to set the rule status to Monitor, which enables you review logs before enforcing the rule. Later, you can also set the rule to Inactive, which means the system is no longer collecting logs, and the rule isn't enforced. 
14. Click Create rule.

Note: When setting up an activity rule, you can use the Condition builder tab, where filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.

Rules page: View and edit your activity rules

After you create an activity rule, you can go to the Rules page to view the rule’s details and scope, the conditions for the rule, and the actions that are triggered when thresholds are met. 

From the Rules page, you can also see a list of all rules that have been created by administrators in your domain. Go to the Google Admin console home page, and click Rules.

From the Rules page, administrators within your domain are able to view rules created by other administrators, depending on the data source for the rule and the privileges of each administrator. For example, an administrator might have view privileges for Drive log events, but not for Gmail log events, and therefore they’re unable to view any rules that are based on Gmail log events.

You can use the Rules page to take the following actions:

• Filter the list of rules by clicking Add a filter. 
• View and edit rule details by clicking one of the rules listed on the Rules page.
• Delete rules.
• Create new rules.
• Click Investigate to open the investigation tool to view data from Rules log events.

Email alerts

If you set up email notifications for your rule, the activity rule will only send one notification email per threshold window when the rule is first triggered and won't send notifications for the other times it's triggered. The email notification contains a summary of the rule that triggered the alert, including the rule name, the threshold details, source data, and more. Administrators who receive the email notification can click View Alert to be taken to the Alert details page in the alert center.

Note: Multiple events that trigger the same rule within the alert threshold time window are aggregated into one email.

Related articles

• Create and manage rules from the Rules page
• Create and manage reporting rules
• Admin access to reporting rules & activity rules