{
  "version": 1,
  "defaults": {
    "enabled": true,
    "cooldownSeconds": 300,
    "action": "log",
    "severity": "low"
  },
  "rules": [
    {
      "id": "personal-web-during-workhours",
      "enabled": true,
      "cooldownSeconds": 600,
      "action": "alert",
      "severity": "medium",
      "message": "Личные ресурсы в рабочее время",
      "when": {
        "categoryGroups": ["personal"],
        "hourFrom": 9,
        "hourTo": 19
      }
    },
    {
      "id": "high-risk-cloud-storage",
      "enabled": true,
      "cooldownSeconds": 900,
      "action": "alert",
      "severity": "high",
      "message": "Подозрительный доступ к облачному хранилищу",
      "when": {
        "domains": [
          "dropbox.com",
          "drive.google.com",
          "mega.nz",
          "onedrive.live.com",
          "disk.yandex.ru"
        ]
      }
    },
    {
      "id": "anonymizer-and-vpn-web",
      "enabled": true,
      "cooldownSeconds": 900,
      "action": "alert",
      "severity": "high",
      "message": "Использование веб-анонимайзеров / VPN-сервисов",
      "when": {
        "domains": [
          "hidemy.name",
          "2ip.ru",
          "whoer.net",
          "protonvpn.com",
          "nordvpn.com"
        ]
      }
    }
  ]
}