Emails you the instant a new person gains access to one of your accounts, or an unexpected admin-level role appears, compared against your approved list of known users. This is your first line of defence against a hijacked account - unauthorised access almost always starts with a new login you didn't add.
Sensitivity - alert on any new user (default), or flip the switch to only admin-level access for stricter, fewer alerts.
Manage known users - edit the approved list this rule checks against (part of your trusted baseline).
Checks every 5 minutes; 7-day cooldown per finding.
How to keep it accurate:
When you legitimately add someone, add them to the known users list.
When they leave, remove them - so a re-appearance would flag.
Treat any alert you didn't expect as a security event first, an inconvenience second.
