Go to Rules, and then click Create rule > Reporting.
Enter a Rule name.
Enter a Description.
Click Next: View conditions.
Choose a data source.
Click Add a filter.
Choose one of the attributes for the filter—for example, Actor, Device type, or Event. Note: For a complete list of attributes and attribute descriptions for each data source, go to Data sources for the audit and investigation page, and choose help articles from the list of data sources.
Choose a value for the filter—for example, the type of event such as transfer document ownership, or the email address for the actor.
You can add multiple filters to the rule by clicking Add a filter again, choosing an attribute, and entering a value.
Click Next: Add actions.
Choose whether or not you want this rule to trigger an alert in the alert center. You can choose a severity of High, Medium, or Low. You can also choose to send email notifications by checking the All super administrators box, and/or by clicking Add email recipients to send emails to select administrators when the rule is triggered.
To review or edit the rule details, click Next: Review.