1️⃣ What is a Sonar rule?
Rules are the unified system behind everything Sonar monitors. Whatever the scope (shared files, third-party apps, AI tools in the browser, email forwarding, public LinkedIn profiles, file downloads, devices), every rule follows the same principle:
Detection: a trigger (for example "a file is public and inactive") combined with conditions you can adjust ("for more than 3 months").
Remediation: what happens when a problem is detected, namely a task for the employee concerned, an automatic action or an alert for the admin.
👍 Good to know: for an overview of the module and what it analyses, see Understanding Sonar.
2️⃣ How a rule is built
Every rule is made up of the same building blocks, presented step by step on its configuration page.
👉 1. The trigger
The situation the rule monitors.
👉 2. The conditions
The thresholds you can adjust to tighten or broaden detection. The stricter a condition, the fewer problems the rule flags.
👉 3. The remediation
What Sonar does with the detected problem. There are three types today:
Employee task: Sonar asks the employee concerned to review the problem (for example, review their public files). These tasks are grouped together at the start of the month.
Automatic action: Sonar fixes the problem itself (for example, anonymising sensitive data in AI tools).
Admin alert: Sonar notifies you, and you can fix it in one click (for example, deleting an automatic forwarding rule).
3️⃣ Rules available today
👉 📁 Files
Public files: files accessible to anyone with the link that have been inactive for too long.
Sharing with a personal account: company files shared with an employee's personal email address.
Dormant partners: external organisations that still have access to your files with no recent activity.
Automatic revocation: automatically revokes access to files that have become inactive.
👉 📥 Downloads
Suspicious downloads ("Suspicious downloads"): unusual days of downloads on Google Drive, SharePoint and OneDrive, compared with each employee's habits over the last 60 days. The employee, then their manager, explain what happened, and unexplained cases go up to the admins. This rule requires Cyber Missions. See Sonar rule: spotting suspicious downloads
👉 🧩 Applications
Sensitive app access: third-party apps connected to your workspace with sensitive permissions on company data.
👉 📱 Devices
Out-of-date devices ("Unpatched devices"): employees' devices whose system has a critical flaw or is no longer supported. The employee receives a task to update them, and you follow each flagged device. This rule is included in the free Sonar plan and requires device synchronisation as well as Cyber Missions. See Sonar rule: reminding employees about out-of-date devices
👉 🌐 Browser
Sensitive data in AI tools: sensitive data entered in an unapproved AI tool is anonymised on the fly by Albert. This rule relies on the Sonar Browser Extension.
👉 ✉️ Email
Automatic email forwarding: employees who automatically forward their work mailbox to a non-work address.
Over-exposed LinkedIn profiles ("Over-exposed LinkedIn profiles"): employees whose public LinkedIn profile shows their full name, photo or job title. Riot finds the profile, asks the employee to secure it, then checks that it has been done. See Sonar rule: securing your employees' LinkedIn profiles.
4️⃣ Reading the rule list and enabling rules
The rule list shows a status for each rule, telling you at a glance where you stand:
rules that are running;
rules that need configuration before they can run.
Rules are opt-in: you enable the ones you want and leave the others paused. You can start with a single rule and add others over time.
When you pause a rule:
it stops detecting new problems;
it stops triggering remediations (tasks, automatic actions, alerts);
problems that are still open are kept;
you can re-enable it at any time.
👍 Good to know: if you are already a Sonar customer, there is nothing to do: your existing monitoring is carried over into the corresponding rules. You can then review the configuration of each rule.
5️⃣ The employee experience
Your employees don't need to understand the rule system: on their side, there are only their usual tasks (Cyber Missions, Karma).
Tasks are grouped together, always at the start of the month, to avoid constantly interrupting them.
Processing is designed in bulk: the employee is asked to review everything above the threshold, presented as a list rather than item by item.
There is still a way out: after 2 pages (20 items per page), the employee can postpone the rest to the following month if they wish.
👍 Good to know: you can preview the employee experience from each rule's configuration page, using the preview button.
👍 Good to know: two rules work differently. The "Suspicious downloads" rule asks the employee straight away, without waiting for the start of the month. The "Unpatched devices" rule sends them a single task, in their next mission, covering all their devices.
6️⃣ Frequently asked questions
👉 Can we enable only some rules?
Yes. Each rule is enabled or paused individually.
👉 Will my employees be overwhelmed with tasks?
No. Tasks are grouped together at the start of the month (except for the "Suspicious downloads" rule, which asks the employee straight away), and you control the volume through the detection conditions: tightening or broadening a threshold directly changes the number of problems flagged.
👉 What happens to our configuration if we are already a Sonar customer?
Nothing to do: your existing monitoring is carried over into the corresponding rules, and you can review the configuration of each one.
👉 Which rules require Cyber Missions?
The "Suspicious downloads" and "Unpatched devices" rules. The "Unpatched devices" rule is not available on Karma.
Key takeaways
A rule combines detection (a trigger and adjustable conditions) and remediation.
Three types of remediation: employee task, automatic action, admin alert.
Rules currently cover files, downloads, applications, devices, the browser, email and public LinkedIn profiles.
The rule list shows which rules are running, which need configuring and which are not included in your plan.
Rules are opt-in: you only enable the ones you need, and you can pause them without losing open problems.
On the employee side, tasks are grouped together at the start of the month and handled in bulk, with the option to postpone any surplus to the following month. The "Suspicious downloads" rule is the exception: it asks the employee straight away.