1️⃣ What is a Sonar rule?
Rules are the unified system behind everything Sonar monitors. Whatever the scope — shared files, third-party apps, AI tools in the browser, email forwarding — every rule follows the same principle:
Detection — a trigger (for example “a file is public and inactive”) plus conditions you can adjust (“for more than 3 months”).
Remediation — what happens when an issue is found: a task for the relevant employee, an automatic action, or an alert for the administrator.
👍 Good to know: for an overview of the module and what it analyzes, see Understanding Sonar.
2️⃣ How a rule is built
Every rule is made of the same blocks, visible from its configuration page.
👉 1. The trigger
The situation the rule watches for.
👉 2. The conditions
The thresholds you can adjust to tighten or loosen detection. The stricter a condition, the fewer issues the rule raises.
👉 3. The remediation
What Sonar does about the issue it found. Three types exist today:
Employee task — Sonar asks the relevant employee to review the issue (for example, review their public files). These tasks are batched at the beginning of the month.
Automatic action — Sonar fixes the issue itself (for example, redacting sensitive data in AI tools).
Admin alert — Sonar notifies you, and you can remediate in one click (for example, remove an auto-forwarding rule).
3️⃣ The rules available today
👉 📁 Files
Public files — files open to anyone with the link that have stayed inactive for too long.
Personal account sharing — company files shared with an employee's personal email address.
Dormant partners — external organizations that still have access to your files but show no recent activity.
Auto-revocation — automatically revokes file access that has gone inactive.
👉 🧩 Apps
Sensitive app access — third-party apps connected to your workspace with sensitive permissions on company data.
👉 🌐 Browser
Sensitive data in AI tools — sensitive data entered into an unapproved AI tool is redacted on the fly by Albert. This rule is powered by the Sonar browser extension.
👉 ✉️ Email
Email auto-forwarding — employees automatically forwarding their work email to a non-business address.
4️⃣ Enable or pause a rule
Rules are opt-in: you enable the ones you want and leave the others paused. You can start with a single rule and add more over time.
When you pause a rule:
it stops detecting new issues,
it stops triggering remediations (tasks, automatic actions, alerts),
issues that are still pending are kept,
you can re-enable it at any time.
👍 Good to know: if you are already a Sonar customer, there is nothing to do: your existing monitoring is carried over into the corresponding rules. You can then review each rule's configuration.
5️⃣ The employee experience
Your employees don't need to understand the rules system: on their side, there are only their usual tasks (cyber mission, Karma).
Tasks are batched, always at the beginning of the month, to avoid interrupting them constantly.
Processing is designed for bulk: the employee is asked to review everything that exceeds the threshold, presented as a list rather than item by item.
There is still an escape hatch: after 2 pages (20 items per page), the employee can postpone the rest to the following month if they wish.
👍 Good to know: you can see the employee experience from each rule's configuration page, using the preview button.
6️⃣ Frequently asked questions
👉 Can we enable only some of the rules?
Yes. Every rule is enabled or paused individually.
👉 Will our employees be flooded with tasks?
No. Tasks are batched at the beginning of the month, and you control the volume through the detection conditions: tightening or loosening a threshold directly changes how many issues are raised.
👉 What happens to our setup if we are already a Sonar customer?
Nothing to do: existing monitoring is carried over into the corresponding rules, and you can review each rule's configuration.
Key takeaways
A rule = a detection (trigger + adjustable conditions) and a remediation.
Three types of remediation: employee task, automatic action, admin alert.
Rules currently cover files, apps, the browser and email.
Rules are opt-in: you enable only the ones you need, and you can pause them without losing pending issues.
On the employee side, tasks are batched at the beginning of the month and processed in bulk, with the option to postpone the rest to the following month.