1. First step is to define what type of activity is the basis for rule set   2. Second step is to define what action is to be done when activity is detected