> ## Documentation Index
> Fetch the complete documentation index at: https://levelblue-final.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Notification Rule for Investigations

| | | | | |
| - | - | - | - | - |
| **Role Availability** | Read-Only | Investigator | Analyst | **Manager** |

USM Anywhere creates a default notification rule that sends an email notification when there is a change to an investigation.

This is a system rule, and the allowed actions are Enable, Disable, and Edit. If you try to delete it, the rule is restored during the next system update. Go to **Settings > Rules** to view this notification rule.

> [!NOTE]
>
> **Note:** By default, this rule is disabled.

> [!NOTE]
>
> **Note:** These rules use the *event\_severity* field with the values low, medium, high, and critical, and the *event\_action* field with the values created, deleted, and updated.

**To enable the notification rule for investigations**

1. Go to **Settings > Rules**.

2. Locate the USM Anywhere Investigations Notification rule and click the ![](https://mintcdn.com/levelblue-final/3ewB6g_LmXIUaKmn/images/usm-anywhere/toggle-off-new.svg?fit=max\&auto=format\&n=3ewB6g_LmXIUaKmn\&q=85\&s=df4f178cdee77e32d08e45103b47e209) icon. This turns the ![](https://mintcdn.com/levelblue-final/3ewB6g_LmXIUaKmn/images/usm-anywhere/toggle-on-new.svg?fit=max\&auto=format\&n=3ewB6g_LmXIUaKmn\&q=85\&s=76d4b0c251e675b56c7220ce1096b523) icon green. To disable the rule, toggle the icon to its original status.

   ![](https://mintcdn.com/levelblue-final/N6pTsZP9q3p7qLdi/images/usm-anywhere/notificationrule.webp?fit=max\&auto=format\&n=N6pTsZP9q3p7qLdi\&q=85\&s=ac9e9485117cf43d5ec1d3ad70ddd20b)

3. Click an investigation to display its details.

**To edit the notification rule for investigations**

1. Go to **Settings > Rules**.

2. Locate the USM Anywhere Investigations Notification rule and click the ![](https://mintcdn.com/levelblue-final/SPmy2LqqTlJThUf-/images/usm-anywhere/pencil-new.svg?fit=max\&auto=format\&n=SPmy2LqqTlJThUf-\&q=85\&s=165bba93fb785be56053c468fb2a06fa) icon.

   ![](https://mintcdn.com/levelblue-final/gDl3ATHF_VgmtV-1/images/usm-anywhere/user-guide/editnotificationrule_new.webp?fit=max\&auto=format\&n=gDl3ATHF_VgmtV-1\&q=85\&s=a784c66735510fd0b36855bf5af4605e)

3. Make the changes as needed and click **Save Rule**. See [Notification Rules from the Orchestration Rules Page](https://cybersecurity.att.com/documentation/usm-anywhere/user-guide/rules-management/notification-rules) for more information on editing notification rules.

> [!NOTE]
>
> **Note:** The destination email field includes the emails of the users created in the environment as the role of Managers. See [Role-Based Access Control (RBAC) in USM Anywhere](https://cybersecurity.att.com/documentation/usm-anywhere/user-guide/user-management/rbac) for more information.