> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Subscriptions

> Turn an activity question into a standing review queue for new matching evidence.

Subscriptions turn a question you want to revisit into a standing watch. Forge
evaluates new activity against the subscription, records each matching event,
and groups matches by session so you can review the evidence as it arrives.
Open any match in Live activity to see the surrounding session and decide what
to do next.

This is useful when a one-time search is not enough: you are validating a new
integration, monitoring a high-risk pattern, waiting for a policy or access
change to take effect, or keeping an investigation open until the pattern
stops. A subscription is a review workflow, not an enforcement rule or a
notification channel.

## Create a subscription

You can create a subscription from the activity experience:

* **From scratch** with natural-language, full-text, or standard-filter
  matching.
* **From a saved search**, preserving its query and scope for future activity.
* **With optional scope filters** for one or more integrations, directory
  users, or devices.
* **With saved-search history** when earlier matches should be included in the
  initial review queue.

Scope filters narrow the candidate activity before the query is evaluated. When
no scope filters are selected, the subscription watches the whole
organization.

## How matching works

Subscriptions evaluate incoming activity and record each event at most once
per subscription. The selected mode determines how the query is applied:

| Mode             | Behavior                                                                             | Best for                                                        |
| ---------------- | ------------------------------------------------------------------------------------ | --------------------------------------------------------------- |
| Natural language | Compares the meaning of the query with indexed event text.                           | Concepts or behaviors that may be expressed in different words. |
| Full text        | Looks for the exact query text in the rendered event text, without case sensitivity. | Known terms, product names, commands, or phrases.               |
| Standard filters | Uses only the selected integration, user, and device scope.                          | A precise source or cohort watch without text matching.         |

Natural-language matching is semantic, so review the first results and narrow
the scope or rewrite the query if it is too broad. Full-text matching is
literal; it does not expand synonyms or interpret a natural-language question.

For a subscription created from a saved search, Forge keeps the saved search's
query and filters. You can choose whether to seed the subscription with the
saved search's existing results or start with new matching activity only.

## What it shows

* Query mode and source (scratch or saved search).
* Scope chips for selected integrations, directory users, and devices.
* The number of matched sessions and matching events.
* The matching method for each event, including semantic, full-text, or
  standard-filter matches.
* Links back to the matching session or event in Live activity.

## Good uses

* Watch for unapproved AI products or known risky phrases.
* Monitor activity from a selected integration, directory user, or device.
* Follow a sensitive cohort while validating a new source or rollout.
* Keep a recurring policy-review pattern visible until ownership or scope is
  settled.
* Track an investigation theme across new sessions without rebuilding the
  search each time.

## Workflow

<Steps>
  <Step title="Start from a question">
    Example: "Which finance devices are using unapproved AI products?"
  </Step>

  <Step title="Build or reuse a search">
    Choose a matching mode and narrow it with integration, directory-user, or
    device scope. Use a saved search when you already have the right query.
  </Step>

  <Step title="Check sample matches">
    Open a few sessions in Live activity to confirm that the results represent
    actionable evidence.
  </Step>

  <Step title="Save the subscription">
    For a saved search, include history only when earlier matches belong in the
    initial queue.
  </Step>

  <Step title="Tune it">
    Narrow noisy subscriptions, or broaden the query and scope when expected
    matches are missing.
  </Step>
</Steps>

## Query examples

| Goal                          | Useful scope                                                                               | Review                                                   |
| ----------------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
| Find unapproved AI usage      | Natural-language or full-text query, optionally scoped to integrations, users, or devices. | Owner, source evidence, and approved path.               |
| Watch known risky activity    | Full-text phrase plus an optional source or device scope.                                  | Whether the activity needs investigation or response.    |
| Monitor a rollout             | Standard filters for a new integration or device cohort.                                   | Data quality, drift, and unexpected adoption.            |
| Follow an investigation theme | Natural-language query plus a narrow user or device scope.                                 | Whether the pattern is still active after response work. |

<Tip>
  A good subscription has a clear next action. If nobody knows what to do when
  it matches, refine the query or make it a one-time investigation.
</Tip>