iManage Threat Manager Help

Matter Activity Rules report on the total activity of a user across selected clients and matters over a defined period. As a user with the Rule Editor role, you can create, modify, delete, or disable Matter Activity rules.

In this section:

Accessing Matter Activity Rules

To access the Matter Activity Rules dashboard, browse to Matter Activity > Rules from the Home screen or the navigation bar.

Creating a Matter Activity rule

Access the Matter Activity Rules dashboard by navigating to Matter Activity > Rules from the Home Screen or navigation bar. In the Matter Activity Rules dashboard, select Add Rule to add a new rule. The New Matter Activity Rule wizard displays.

To create a Matter Activity rule, you will:

1.) Matter Activity rule: Create

To create a Matter Activity rule:

Browse to Matter Activity > Rules
Select Add Rule.

Next, enter the General details.

2.) Matter Activity rule: General details

Specify the rule name and time zone in the General section of the page:

Rule Name: Enter a name for the Matter Activity Rule. This rule name can be up to 74 characters in length.
Time Zone of Users: The default system time zone set by your Configuration Manager is displayed here. However, you can choose to change the time zone per Matter Activity Rule. The time zone controls the definition of the day boundary while determining the period across which analysis is performed. For example, if the time zone of the rule is set to Eastern Standard Time (EST), the day boundary is defined as the 24-hour interval starting at 00:00 EST (UTC-5). Select Time Zone of Users. The drop-down list displays the time zones and you can select the time zone of your region from the list, for example, America/New_York. Entering text in this field filters the list.

3.) Matter Activity rule: Clients and Matters

In the Clients & Matters field:

Select Edit. The Clients and Matters dialog opens.
In the dialog, select the clients and/or matters that you want to include for this Matter Activity rule. You can select clients from the Clients tab, and/or select Matters from the Matters tab, as follows:
- Clients: Select the Clients tab. Select the Magnifying Glass icon in the search field. A list of available clients is displayed. Alternatively, enter the name of a client in the search field. As you type, the list of names is refined. Select the check boxes for clients that you want to include in activity counts.
- Matters: Select the Matters tab. Select the Magnifying Glass icon in the search field. The list of available matters is displayed. Alternatively, enter the name of a matter in the search field. As you type, the list of names is refined. Select the check boxes for matters that you want to include in activity counts.

NOTE: To remove a client or matter from the included or excluded lists: In the row of the client or matter, select the three dots icon > Remove. Alternatively, to remove more than one client or matter at a time, select the check boxes next to the relevant client or matter, and then select Remove.

After you've specified the clients and matters required, select Done.

The count of clients and/or matters that are included in the Matter Activity Rule is shown in the Clients & Matters field.

4.) Matter Activity rule: Rule Frequency

You can schedule the rule to recur, or run the rule just once across a specified time period for analysis.

For a Scheduled rule, you need to specify the following:

Repeats: Hourly, Daily, Weekly, or Monthly.
- If you select Weekly or Monthly, then specify the day of the week upon which the report will run.
Start time: Select the start time.
Report on activity across the last [...] days: Specify the number of days to scan data (that is, monitor activity) from. When the rule runs, iManage Threat Manager looks for activity during this scan period. For example, if you choose Weekly, the default value for Report on activity across the last [...] days is set to 7 days from the time the rule is run. Therefore, when the rule is run, Threat Manager looks for activity during the last 7 days.

Select Run once to run the rule once across the time period that you have specified for analysis. This type of rule doesn't recur. To use this option, select the date range of the data for which the rule will be applied when run. Choose from Last Week, Last Month, Last 3 Months, Last 6 Months, Last Year, or a custom start and end date.

5.) Matter Activity rule: Activities

In this field, you can select the types of activities (activity set) that'll be monitored/counted for the rule.

We recommend that the default activity sets provided in iManage Threat Manager activity be used for analysis, in typical situations. However, the option is available to modify these values.

The default activity set for matter activity rules is the Activity Monitoring set.

NOTE: We recommend that you use this (iManage Threat Manager default) Activity Monitoring activity set when creating Matter Activity Reports.

You can, however, select an alternative activity set, or specify a custom set:

To change the activity set, select Edit. The Add/Remove Activities dialog appears.
1. Then select an existing activity set:
  1. Select Select Activity Set. A drop-down list appears.
  2. Select the required activity set from the drop-down list.
  3. Select Update. The selected activity set is applied to the rule.
2. To specify a custom activity or list of activities that'll be monitored/counted for the rule:
  1. Select the check boxes to the left of those activities, in the list of activities shown.

NOTE: We recommend that you use the default activity sets provided in iManage Threat Manager activity for analysis, in typical situations. However, the option is available to modify these values for a given rule.

Activity sets can be modified by a user with Configuration Manager role. Refer to the Configuration sections in iManage Threat Manager Administration Help.

For more information about activities, refer to What are Activities? in Frequently Asked Questions.

ii. Select Update. The specified activity list is applied to the rule.

6.) Matter Activity rule: Users & Groups

Specify the Users & Groups whose activity on the selected clients and matters will be excluded from the rule. By default, the Global Exclusions List is excluded. This means that the rule will scan activity across all users, excluding those in the Global Exclusions List. You can specify users and groups to exclude from the rule.

In the Exclusions panel, select Edit. The People to Exclude dialog appears and a list of available users and groups is displayed. Refer to the table below.
Use the filters as required and select the check boxes for the users and groups, to exclude those users or groups from the scope.
After you've excluded all the users and groups required, select OK. A list of the excluded users and groups is displayed in the Exclusions panel.

Table: Types of users

Icon	Type	Description
	Active User	An active and valid user in the system.
	Disabled User	The User ID exists in the system. However, it's in a disabled state.
	Group	An active and valid group in the system.
	Disabled Group	The Group ID exists in the system. However, it's in a disabled state.
	Deleted User	The user ID doesn't exist in the Users table. There may be multiple reasons for this scenario. For example, Deleted users arise when the user doesn't exist in the doc-users table, but audit entries on the user's behalf exist in the audit table. This typically arises when third-party developers write customizations that make these entries directly into the database.

7.) Matter Activity rule: Notifications

Matter Activity email notifications are sent each time the Matter Activity rule is run. You can add users as primary, CC, or BCC recipients, regardless of whether they use iManage Work. The emails include:

Rule name of the Matter Activity report
Reporting period covered by the report
Clients and matters selected during report creation
Users who performed activity on those clients and matters during the reporting period
A link to view the report

To set the Matter Activity rule Notifications:

Under Notifications, select the required notification option from:
- Never Notify: When this option is selected, no notifications are sent.
- On Every Run: When this option is selected, email notifications are sent each time the Matter Activity rule is run. You must select at least one user to whom the notifications must be sent. You’ll do that in the following step.
If you've opted to send notifications On Every Run, the Users to Be Notified panel is displayed.
1. Add iManage Work recipients.
  1. Under To, select Edit.
  2. In the Users to be Notified dialog, use filters as needed and select the check boxes for iManage Work users or groups who should receive alerts. You must select at least one.
  3. Select OK to confirm. The selected recipients are listed in the Notifications section.
2. (Optional) Add non-iManage Work recipients.
  1. Under Other Users, enter an email address and then press space, Enter, or comma to add it to the list.
  2. Repeat for additional addresses, as needed.
  3. To remove an entry, select the “X” next to its name.
3. (Optional) Enable the CC and/or BCC options, then repeat Steps 2a and 2b for each one.
Continue to the following step to save and activate the rule.

8.) Matter Activity rule: Save and Activate Rule

After configuring all rule components, select Save and Activate Rule to deploy it. A success message confirms the deployment. To view a summary of the rule, open its Rule Details.

Each rule is automatically assigned a Rule ID by iManage Threat Manager. This non-editable ID reflects the order in which the rule was created.

Viewing and editing Matter Activity Rules: Active, Disabled and Historical

The Matter Activity Rules dashboard lists Active Rules and Disabled Rules, and provides a detailed History of all current and former Matter Activity Rules. You can create new Matter Activity Rules and manage existing rules from this dashboard.

The Matter Activity Rules dashboard contains the following tabs:

Active Rules
Disabled Rules
History

The Matter Activity Rules dashboard also provides the following features:

Pagination: Lets you switch between the pages of information by using the left and right arrow keys at the bottom of the page.
Sorting: Useful for viewing the content in ascending or descending order.
Drill-down: Lets you get additional details from the tabular views in the application.
Columns shown: Select the Configuration icon to adjust which columns are displayed. Note that the Name column is always shown and can't be hidden.

NOTE: An exclamation mark icon is displayed beside the last run date (column) of any rules which haven't executed successfully.

(If this occurs, you can check the system logs. For more information, refer to Logs in the Configuration - Settings page of the iManage Threat Manager Administration Guide.)

Active Rules

You can perform the following operations from the Active Rules tab:

NOTE: To perform any of these operations on an active rule listed in the Active Rules tab, select the Three Dots icon to select from the options View, Edit, Run Now, Disable, or Delete.

View active rules

There are two ways to view the details of an active rule. You can either select the Three Dots icon in the row of a rule and select View, or you can drill down by selecting a rule from within the list of Active Rules. In either case, the Rule Details tab and the History tab are displayed with details pertinent to the selected rule:

The Rule Details tab provides a summary of the rule with details about Clients and Matters covered by the rule, Frequency (that the rule is run), Timezone, Notification List (list of users who'll receive notifications for the rule), and the list of Selected Activities for that rule.
The History tab provides details about the date and time when an action was performed on that rule, the action performed, by whom, and comments if any. (The Comment column accommodates entries of up to 2,000 characters, and each comment can be selected to view the full text.)
The Rule Summary details are seen in the side bar when you select a row from the details in the History tab. This sidebar summarizes the changes to the rule for each action performed on that rule.

Edit active rules

Select the Three Dots icon in the row of the rule that you want to edit and select Edit. Alternatively, select the row of the rule you want to edit, and then Edit Rule to start editing the rule. The Matter Activity Rules tab appears in edit mode.
Navigate through the tabs and make the required changes to the rule.
Select Update to save your changes to the Matter Activity Rules.

You can also edit a rule from these tabs:

Active Rules: Select the Rule Name and select Edit Rule.
Disabled Rules: Select the Rule Name and select View. Then select Edit Rule.
History: Select the Rule Name and select Edit Rule.

NOTE: Although it's possible to edit active and disabled rules, you can't edit deleted rules.

Run active rules on demand

Select the Three Dots icon in the row of the rule that you want to run and select Run Now. You can run a rule on demand, even if it is configured to run on a schedule. Running on-demand won't affect the scheduled running of the rule.

Disable active rules

Select the Three Dots icon in the row of the rule that you want to disable and select Disable.
You'll be prompted to provide a reason for disabling the rule.
After entering the reason, select Save. The list of active rules is refreshed and the disabled rule is no longer listed under the Active Rules tab. It is now listed under the Disabled Rules tab. From the time of its disablement, the disabled rule can no longer be used for report generation.

A disabled rule can be reactivated, if required, at any point in time. To do so:

Select the Three Dots icon in the row of the disabled rule in the Disabled Rules tab.
Select Activate.

Now, the rule is seen listed in the Active Rules tab and the rule starts to generate reports from the time that it's activated, under the schedule of the report.

Delete active rules

Select the Three Dots icon in the row of the rule that you want to delete and select Delete. The Delete Rule confirmation pop-up window appears. The pop-up window displays a warning to inform you that this action can't be undone or reversed.
Select OK. The rule is deleted. The History tab is updated to show the deleted rules.
In the History tab, select the rule to drill down and see the Rule Details tab and the History tab with a list of actions performed on the rule and other details.
Select a row in the History list and additional details are displayed in the sidebar.

Disabled Rules

You can perform the following operations from this tab:

View disabled rules
Activate disabled rules
Delete disabled rules

View disabled rules

Select the Three Dots icon in the row of the disabled rule that you want to view.
Select View. The Rule Details and History tab are displayed for that rule.

You can edit (and reactivate) disabled rules, but you can't edit deleted rules. To do so:

In the Rule Details or History page of that rule, select Edit Rule at the upper right-hand side of the page. The Monitoring Rule appears in edit mode.
Make the required changes and select Update to save any changes to the rule.

NOTE: When you select Update, the rule will be activated, and can be seen listed in the Active Rules tab.

Activate disabled rules

It's possible to resume or activate a disabled rule at any time.

Select the three dots icon in the row of the disabled rule that you want to activate.
Select Activate. The system prompts you to enter a reason for modifying a rule. Now, the rule is seen listed in the Active Rules tab and the rule starts to generate reports from the time that it's activated and according to the schedule defined in the rule.
The History tab is updated to show the enabled rules.
In the History tab, select the rule to drill down and see the Rule Details tab and the History with a list of actions performed on the rule and other details.
Select a row in the History list and additional details are displayed in the sidebar.

NOTE: You can also edit and activate disabled rules in a single step.

Delete disabled rules

Select the Three Dots icon in the row of the disabled rule that you want to delete and select Delete. The Delete Rule confirmation pop-up window appears. The pop-up window displays a warning to inform you that this action can't be undone or reversed.
Select OK. The rule is deleted. The History tab is updated to show the deleted rules.
In the History tab, select the rule to drill down and see the Rule Details and History tabs with a list of actions performed on the rule and other details.
Select a row in the History list and additional details are displayed in the sidebar.

History

You can perform the following operations from the History tab:

View the history of all rules.
Drill down and view the Rule Specifics and History of actions performed for the selected rule.

The History tab lists all actions performed on all the rules: Rule Names, the Date, and Time when the action was performed, and comments, if any. The history table list is sorted to show the rules with the most recent activity on top of the list. If you select a specific rule (row), then the Rule Details tab and History tab are displayed. These provide more details about the selected rule. Every activity about a rule is tracked in the History tab for that rule:

Rule Details: Provides a summary of the rule with details about Clients and Matters covered by the rule, Frequency (that the rule was run), Timezone, Notification List (list of users who received notifications for the rule), and the list of Selected Activities for that rule.
History: Traces all the actions performed on that rule, the date and time when the actions were performed on the rule, the User performing the action, and comments, if any. (The Comment column accommodates entries of up to 2,000 characters, and each comment can be selected to view the full text.)
Rule Summary details: Shown in the side bar when you select a rule (row) from the list in the History tab.