Drift Score
85Healthy
Active Alerts
0
Requires attention
Resolved This Month
14
↑ 23% vs last month
Mean Time to Resolution
3.2hrs
↓ 18% improvement
Active Drift Alerts0
No active drift alerts
All compliance controls are within expected parameters.
Alert Rules Configuration
| Rule Name | Trigger Condition | Severity | Channel | Active |
|---|---|---|---|---|
| New Super Admin Created | Super Admin role granted to any user | critical | email+slack | |
| MFA Disabled for Any User | MFA enrollment removed from user account | high | email+slack | |
| External Sharing Spike | >20 files shared externally in 24h | high | ||
| Inactive Admin Account (90d) | Admin with no login in 90 days | medium | ||
| Public Shared Drive Created | Shared drive created with public link | medium | ||
| Weak Password Detected | Password strength below minimum threshold | low | dashboard | |
| Suspicious Login (New Country) | Login from IP in new geographic location | high | email+slack | |
| Admin Role Not Used (30d) | Admin privileges unused for 30+ days | medium | ||
| Bulk Data Export | Export of >1GB data from Workspace | medium | ||
| Group Membership Change | Bulk addition to sensitive group | medium | dashboard | |
| Account Suspension Lifted | Previously suspended account reactivated | low | dashboard | |
| Password Reset Storm | >10 password resets in 1 hour | medium | ||
| External Member Added to Drive | Non-domain member added to shared drive | low | dashboard | |
| Sign-in from Known Bad IP | Login from threat intelligence flagged IP | critical | email+slack+sms | |
| Service Account Key Created | New API key created for service account | high |
Notification Settings
Email
soc@anwsol.com
All severities
Slack
#compliance-alerts
High & Critical only
Teams
Compliance Team
Medium & above
SMS
On-call rotation
Critical only
Quiet Hours
Low severity alerts suppressed 10:00 PM – 6:00 AM (client timezone). Critical alerts always delivered.