📚 Step 10 of Your Riot activation journey.
⬅️ Previous step: 9️⃣ Enable reporting and malicious email detection
💡 Prerequisite: having completed the setup of your workspace (steps 1 to 6).
A file shared publicly and forgotten, a document sent to a personal address, a mailbox automatically forwarded outside: data leaks often come from small everyday actions. Sonar spots them using rules: each rule monitors a risky situation and says what to do when it detects it. In this step, you connect Sonar to your tools, then turn on your first rules.
💡 Prerequisites:
Administrator access to Riot, and being signed in to hub.tryriot.com;
a plan that includes the Sonar module;
your employees synced from Google or Microsoft (step 1), and access to the Google Workspace or Microsoft 365 admin console. If you don't have it, complete this step with your IT team.
❶ Connect your storage tools
👉 Step 1: Open Sonar
👍 Good to know: you can browse the rules and their configuration before granting any permission. Useful to get an idea before involving your IT team.
👉 Step 2: Connect Google or Microsoft
In the Cloud integrations section, connect your storage tool:
Google (Google Drive), if your employees are synced from Google;
Microsoft (OneDrive and SharePoint), if your employees are synced from Microsoft.
Each permission requested is explained in plain language when you connect. On Google, authorisation is completed in the Google Workspace admin console. Details of the permissions, and why they are needed, are in Set up Sonar (Microsoft and Google).
👉 Step 3: Choose your level of control (optional)
During the connection, two options can be turned off:
write access: Sonar then stays read-only and won't be able to restrict or remove a share automatically;
file content analysis: Sonar then assesses the risk only from the file names and their information (owner, date, location).
You can also exclude certain people (for example an executive's Drive) or certain shared drives from the analysis. All these choices can be changed at any time.
👍 Good to know: write access is only used to restrict or remove a share, never to change the content of your files. You can revoke the permissions at any time from your Google or Microsoft console.
👉 Step 4: Let Sonar run its first scan
The scan starts automatically. It takes a few minutes, and up to several hours for large organisations. You can set up your rules in the meantime.
❷ Turn on your first rules
👉 How a rule works
Each rule combines:
a detection: the situation being monitored (for example "a file is public and inactive"), with conditions you adjust ("for more than 3 months");
a remediation: what happens when a problem is detected. Depending on the rule, Sonar asks the employee concerned to fix it, fixes it itself, or alerts you so that you can fix it in one click.
👉 Where to start?
Rules only run if you turn them on: you can start with just one and add more over time. To protect yourself against data leaks, start with these:
Public files: files that anyone with the link can access, and that have been inactive for too long;
Sharing to a personal account: company files shared with an employee's personal address;
Dormant partners: external organisations that still have access to your files without recent activity;
Automatic email forwarding: employees who automatically forward their work email to a non-work address.
Other rules cover connected third-party apps, sensitive data entered into AI tools, over-exposed LinkedIn profiles, suspicious downloads or out-of-date devices. The full list is in Sonar rules.
👍 Good to know: the "Suspicious downloads" and "Unpatched devices" rules go through Cyber Missions. They will only work once your missions are activated, at the last step of the journey.
👉 Turn on a rule
In Sonar, open the list of rules. Each rule shows its status: running, or to be configured.
Click the rule. Its configuration page presents, step by step, the detection, the conditions and the remediation.
Adjust the conditions if needed: the stricter a condition, the fewer problems the rule raises.
Use the preview button to see what the employee will receive.
Turn on the rule.
A rule can be paused at any time: it stops detecting and acting, but the problems already found are kept.
❸ What your employees see
They don't need to understand the rules system: they simply receive tasks in their Cyber Missions.
Tasks are grouped at the start of the month, so as not to interrupt them constantly, and presented as a list to deal with in one go.
Beyond 2 pages of 20 items, they can postpone the rest to the following month.
👍 Good to know: the "Suspicious downloads" rule is the exception: it asks the employee immediately, without waiting for the start of the month.
🛠️ A problem?
Google or Microsoft isn't offered when connecting: check that your employees are synced from that tool (1️⃣ Sync your employees).
To understand what Sonar analyses: Understanding Sonar.
Still stuck? Contact our team via the chat in the platform.
Key takeaways
Connect Google Drive or OneDrive / SharePoint from the Sonar menu; the first scan starts automatically.
You stay in control: read-only possible, content analysis can be turned off, people and drives can be excluded.
A rule = a detection + a remediation. Start with the rules on files and email forwarding, then add more.
Your employees receive their tasks in their Cyber Missions, grouped at the start of the month.
🎉 Congratulations! If you've made it this far, you have set up and activated your Riot modules.