When a lot of files are downloaded at once, this is often how company data leaves: an employee taking files away before leaving, or an attacker using their account. The Sonar rule "Suspicious downloads" monitors downloads on Google Drive, SharePoint and OneDrive. It spots unusual days for each employee and first asks the employee, then their manager, to explain them. Only the cases that remain unexplained reach you.
👍 Good to know: the rule is available to all Sonar customers. It requires your workspace to have moved to Cyber Missions. See Sonar rules to understand the rules system.
1️⃣ How the rule works
👉 1. Riot monitors downloads
Riot observes file downloads on Google Drive, SharePoint and OneDrive.
👉 2. The employee explains
When unusual activity is detected, the employee is asked straight away: did they really download these files?
👉 3. The manager validates
Their manager says whether this download is part of their work.
👉 4. Admins handle the rest
Anything left unexplained goes up to the admins. Most downloads are explained in one click by the employee and manager: only doubtful cases reach the security team.
2️⃣ How Riot decides that a download is unusual
Riot does not rely on one limit that is the same for the whole company. Two criteria are combined:
A threshold per employee: a day of downloads is compared with that same person's habits over the last 60 days;
What is downloaded: sensitive files, night-time hours, many shared drives.
A busy day with nothing unusual in what is downloaded triggers nothing.
3️⃣ Enabling the rule
💡 Prerequisite: be logged in to hub.tryriot.com with an account that has Admin access to Sonar.
👉 Step 1: log in to hub.tryriot.com with your Admin account.
👉 Step 2: open the Sonar -> Rules module, then the list of rules.
👉 Step 3: click the "Suspicious downloads" rule and turn it on.
4️⃣ Following downloads
A new Downloads tab in Sonar's Explorer shows download activity.
5️⃣ The employee and manager experience
The employee is asked immediately, without waiting for a mission or the start of the month: unusual activity triggers the question right away.
They say whether they are behind the download.
Their manager then says whether this download is part of their work.
Anything left unexplained goes up to the admins.
👍 Good to know: this is specific to this rule. For most other Sonar rules, tasks are grouped together at the start of the month (see Sonar rules).
6️⃣ Frequently asked questions
👉 Will a heavy working day trigger an alert?
No, not on its own. The threshold is specific to each employee, and Riot also looks at what was downloaded: sensitive files, night-time hours, many shared drives. A busy day with nothing unusual triggers nothing.
👉 Who sees the cases that come up?
The employee answers first, then their manager. Cases that remain unexplained reach the admins, who follow the activity in the Downloads tab of the Explorer.
👉 I can't see the rule in Sonar. Why?
The rule requires your workspace to have moved to Cyber Missions.
Key takeaways
The "Suspicious downloads" rule monitors downloads on Google Drive, SharePoint and OneDrive.
The threshold is calculated for each employee, based on their habits over the last 60 days, and takes into account what is downloaded.
The employee answers first, then their manager. Only unexplained cases reach the admins.
Admins follow the activity in the Downloads tab of the Explorer.
The rule is available to all Sonar customers and requires Cyber Missions.