Rules

Rules is under Workflows → Rules in the sidebar at /workflows/rules. Rules let you define what events matter and what should happen when they occur — automatically, in real time.

​

How rules work

A rule has three parts:

1. Trigger — the event type that starts the evaluation
2. Conditions — AND-matched filters that narrow which events activate the rule
3. Actions — what happens when all conditions match

Rules evaluate in real time as events arrive from your connected integrations.

​

Creating a rule

1. Go to Workflows → Rules
2. Click New Rule
3. Give it a name and optional description
4. Choose a trigger type
5. Add conditions
6. Configure one or more actions
7. Set the rule to Active and save

​

Trigger types

​

Conditions

All conditions must match (AND logic). Conditions narrow the trigger to specific cases: For apps: category, risk level, shadow IT status, discovery source, approval status
For OAuth grants: risk level, permission scopes, grant age, publisher trust score
For users: group membership, department, directory status, last active date

​

Actions

​

Example rules

​

Alert on new high-risk shadow IT

• Trigger: Resource — New app discovered
• Conditions: Approval status = Pending, Risk level = High or Critical
• Action: Notify #security-alerts Slack channel

​

Flag stale OAuth grants

• Trigger: OAuth Grant — Not used in N days
• Conditions: Days since last use ≥ 90
• Action: Create finding (Medium), assign to IT admin

​

Watch for deprovisioned users with active access

• Trigger: Account — User deactivated in directory
• Conditions: User has active app assignments
• Action: Notify IT admin + create finding (High)

​

Track new AI tools being adopted

• Trigger: Resource — New app discovered
• Conditions: AI classification = AI Primary or AI Enhanced
• Action: Notify IT lead, assign for review

​

Trigger an offboarding playbook automatically

• Trigger: Account — User deactivated
• Action: Trigger Playbooks — Employee offboarding

​

Managing rules

Active / Paused — toggle rules on or off without deleting them. Useful when you want to temporarily suspend a noisy rule without losing its configuration. Rule log — see a history of every event that triggered each rule and what action was taken. Essential for debugging why a rule did or didn’t fire. Edit — modify conditions and actions at any time; changes take effect immediately on the next matching event. Duplicate — create a copy of an existing rule as a starting point for a new one.

​

Current limitations

Rules currently support AND-only condition matching — all conditions in a rule must match. For OR scenarios (e.g. “alert if risk is High OR Critical”), create two separate rules with each condition.

​

Next steps