We have expanded our IM monitoring and behavior rules to include the WhatsApp Desktop app. This update extends visibility beyond the browser, complementing our existing WhatsApp Web coverage to provide deeper oversight into employee communications and enforce automated rules, such as detecting insider risks or preventing data exfiltration.

The Windows Stealth Agent installer now supports a TMCLIPMONEXE parameter that lets you set a custom name for the clipboard monitor service (replacing the default “clm.exe”). This makes it easier to obfuscate the process name according to your own preferences.

To set a custom name, include the TMCLIPMONEXE parameter in your installation command:

Syntax:

Example:

We've enhanced the AD/LDAP integration with a new MAP IMPORTED ATTRIBUTES option. You now have granular control to map each imported AD attribute to either a core Teramind employee field (like Department, Position, Email, Phone, etc.) or retain it as a “Custom field” under the employee’s LDAP attributes section and use in BI report filters.

These persistent mappings are automatically reused on every sync, ensuring employee profile fields remain accurately aligned with your directory and preventing unwanted data overwrites.

For more details, please refer to the Settings > Active Directory section of the Teramind User Guide.

We have added support for tracking the AI Mode feature within Google Search. All chat interactions and file uploads are tracked and can be viewed on the LLM BI Report, providing visibility into AI tool usage for compliance and productivity tracking.

1. Add the “GoogleAI Web” option under the LLM monitoring setting.

2. You will be able to view the AI Mode interactions under BI Reports > LLM.

Mac Agent now supports monitoring of ChatGPT Web sessions. This feature tracks all user prompts and the corresponding AI-generated outputs, with data visible in the LLM BI report:

For more information, please refer to the BI Reports > LLM section of the User Guide.

The Mac Agent now tracks file uploads to Google Drive across all major browsers, including Safari, Chrome, Firefox, Opera, Brave, and Edge. This provides comprehensive visibility into cloud file transfers, helping organizations monitor data movement and prevent data leaks. You can track these uploads in reports like BI Reports > Web File Events.

You can now create Files Activity rules to detect file uploads made to Google Drive via web browsers. You can use relevant criteria such as File Operation (Upload), Upload URL, Upload File Name, etc. This allows you to enforce policies, trigger alerts, or take automated actions when files are uploaded to this popular cloud repository, enhancing data security and compliance.

We've enabled support for capturing screen recordings only when a behavior rule is violated. This targeted approach provides several key benefits, including reduced storage needs by avoiding continuous, unnecessary recordings and optimized performance for your system. Additionally, this method enhances user privacy and ensures cleaner evidence by capturing only clear, relevant proof of policy violations without the filler of routine daily activity.

Turn on the RECORD ONLY WHEN BEHAVIOR RULE WAS VIOLATED option in the Screen monitoring settings and then use the RECORD VIDEO rule action with any supported rule to automatically capture a video clip of a rule violation incident. You can specify how many minutes before and after the incident the recording should be.

For more information check out the documentation for SCREEN monitoring settings and the RECORD VIDEO rule action.

Emails Activity rules on Mac now fully support Shared Lists in the To, CC, and From fields. Relevant conditions and logic, such as “Matches list”, “Equals list”, and “Except” are supported. This update allows you to quickly apply rules to multiple email recipients or senders and reuse the same list across different rules without manual duplication.

We’ve improved the Mac Agent to better support environments that use Palo Alto Networks GlobalProtect VPN for all network access to perform SSL inspection / certificate injection on web traffic. The Agent now includes three configuration parameters that can be used to keep network monitoring working correctly when traffic is forced through the VPN.

Behavior alert rule description now provides clearer context for rule violations that occur during a locked session. Alerts triggered while a user's device is locked will now be marked with a “(Locked Session)” label.

This enhancement provides analysts with immediate context, enabling faster triage, more accurate risk assessment, and clearer explanations during reviews and audits. It also helps distinguish genuine user activity from background or system processes, improving the signal-to-noise ratio in alert investigations.

This update adds a Session Player Url column to the BI Reports > Behavior Alerts and a corresponding session_player_url field to the /tm-api/wip/tma-query API call response. The column/field links to the exact session playback around the time of the alert.

This means you no longer need to manually search for the right session or scrub through long recordings to find the relevant event. Another critical benefit is seamless integration with external tools, such as SIEM, SOAR, ITSM, or custom systems, where this URL can be surfaced alongside alert details so that you can open the corresponding session directly from those systems.

The legacy Fulltext search option has been removed from the Monitoring > OCR report. This change streamlines the search experience, prevents redundancy with other search capabilities, and ensures consistency with Teramind NextGen.

Why the Change? The "Fulltext" option often duplicated other search functions, could be inconsistent, and added complexity without significant value.

Alternative: You can continue to perform all necessary searches using the more predictable and flexible Contains and Regexp search modes already available in the OCR report.

We’ve introduced support for STIG environments on Edge and Chrome browsers. This is achieved by enhancing how the Agent handles requests to confirm that a certificate has not been revoked. The generated certificates now include all necessary revocation information, which ensures secure and smoother web accessibility while maintaining continuous web traffic monitoring in STIG-compliant environments.

The macOS Agent now stores the Computer ID (CID) locally at:

It also includes it in ping requests, bringing it to parity with Windows Agent behavior. This provides a reliable, static identifier for scripts and API calls, simplifying Agent health validation and check-in tracking.