This guide explains how to utilize Teramind’s behavioral rules to detect insider threats, protect your organization from malicious or accidental security incidents, prevent data loss, conform with regulatory compliances or improve the productivity of your team. The guide explains rule structures, conditions, logic, data types etc. It shows you the steps for creating a rule, their uses cases, best practices and advanced capabilities.

The guide is designed for the managers, administrators and security personnel who are responsible for configuring and maintaining the Teramind solution in your organization.

You can download a PDF version of the guide by clicking the button below.

Behavioral rules are a core part of Teramind’s automated insider threats detection and data loss prevention capabilities. They allow you to identify unproductive, harmful or dangerous activity in real-time and optionally, act on your behalf to thwart such threats. The Intelligent Rules Engine is tightly integrated throughout Teramind platform:

With hundreds of pre-built rule templates, pre-defined data categories and sample rules, you can get started with Teramind right away. You can create your own rules very easily with an intuitive, visual Rules Editor. The editor allows you to use natural language, regular expressions, shared list and pre-built data classifications to define what makes an activity or data sensitive and use simple conditions that will trigger a rule violation incident. When a rule is violated, you can be notified about the incident and optionally, the system can take actions automatically in different ways, such as: warning the user, blocking the activity etc.

Teramind keeps detailed records of each rule violation incident complete with detailed information and relevant metadata. You can see the rule violations report from the Alerts screen and quickly search for an incident.

Teramind also captures video and optionally, audio for a rule violation incident. You can view the recordings with the Session Player. The player allows you to see what rule notifications the user received and the trail of activities leading up to the incident. You can also export recordings for evidence or forensic investigation purposes. These recordings are automatically analyzed and index by Teramind’s advanced OCR-engine. You can conduct high-speed OCR search for on-screen content or create OCR rules that will activate whenever certain text is detected on the screen, in real-time.

You can conduct risk analysis and identify high risk rules, users or objects from the Risk report. This also gives you ideas on how to adjust your rules’ detection settings to focus on key areas of vulnerabilities or reduce false positives.

Finally, you can get scheduled delivery of rule violation reports or ‘just-in-time’ notifications in your inbox with the Email Notifications feature.

You can create powerful rules to prevent data loss, detect insider threats, identify abusive behavior and accidental threats, improve employee productivity and conform with regulatory compliance.

Teramind MITRE ATT&CK Detection & Prevention Library has over 350 sample behavior policies and rules under 13 MITRE Tactics covering the Enterprise Attack Matrix. The rules are designed to detect threat-specific activity, content classification, pre-defined alerts and automated actions and a documented response playbook tailored to each defined scenario.

For more information about the Teramind MITRE ATT&CK Detection & Prevention Library please contact [email protected].

Consider what you are trying to achieve. Do you want to monitor users’ activities to prevent insider threats? Suspicious that an employee is committing a crime or colluding with an outsider? Or, are you trying to prevent IP leaks through external vendors? Do you need to comply with regulations, such as: HIPAA, GDPR etc.?

Are you trying to detect discrepancies in employees’ schedule? Does it involve an ‘activity’ such as, uploading a document? Or do you need to protect some ‘content’ such as, sensitive information inside a document?

If you are trying to detect behavioral anomalies such as an employee sending abnormal amount of emails than normal, then you should consider creating an anomaly rule.

Next you need to figure out where the activity or content sharing takes place. Does it involve emails? Transfer of files? Or, are there multiple ingress/egress points that you need to monitor, for example, emails + IM + website uploads?

Do you want the rule to run 24/7 or follow a schedule? For example, do you want the rule active during work hours but disable it during the employee lunch breaks?

Do you need the rule for everyone? Certain users, groups or departments? How about setting up a terminal server to monitor all your vendors or external partners? Do you need to exclude anyone from the rule’s enforcement?

If you are trying to detect Content, can you describe how the data looks? Does it have a clear structure such as a credit card number? Or, do you need to detect information that are unstructured or dynamic in nature?

Now, you have to think about scenarios that will trigger the rule. You might need multiple conditions and logics to detect the rule violation. Remember, there are also multiple ways of achieving the same result.

For example, if you wanted to prevent uploading of files to a personal Cloud drive, you could use a condition to detect file operation ‘upload’. And use a second condition, ‘upload URL’ and specify website addresses such as ‘google.drive.com, dropbox.com’ etc. Or, you could just select file operations for ‘write’ and select the ‘Cloud providers’ from the built-in list.

What should the system do when a rule is broken? Do you want it to notify you immediately? Or, do you want it to take some preventive actions too? For example, block the action? Or do you need to take a sequence of actions? For example, block the action but also record the incident? Or, take different action depending on how often they broke the rule? Assign a risk level to the action?

Each rule lets you specify a name and optionally, a description for the rule.

1. When creating a new rule, you can choose from a list of pre-built templates. Click the CHOOSE A TEMPLATE field to choose a template on the General tab. Teramind has many templates for Data Loss Prevention, Email, Applications, Websites, File Operations etc. Once you select a template, the rest of the rule’s tabs will be automatically populated with pre-configured settings and sample data. You can, of course, change the settings.

Just under the rule templates selection, you will notice an option, “Display in OMNI feed”. If enabled, the rule will show up on the OMNI dashboard.

Tags are keywords you can assign to a rule to easily identify it. They are useful in searching for the rule and can also be used as filters (i.e. on the Risk or Alerts report).

You might also see some built-in tags such as Data Loss, Malicious Incident, Negligence, etc. that you can assign to the rule. These special tags are used with OMNI to categorize different types of risks.

By default, the rule stays active for 24 hours. However, you can adjust it to match your employee work schedule. For example, you can have the rule active during work hours but disable it during the employee lunch breaks. To change when the rule is active, drag the two Circles to adjust the time. You can click the Plus (+) and Minus (–) buttons to add/remove additional time slots.

The Rule Violation Severity allows you to specify a risk level for the rule. You can either drag the slider or use the number field to enter a number between 0-100. This value is then used in places like the OMNI to measure the overall risk score.

You use the CONDITION fields in a rule to specify what values to compare the rule parameters with. To specify a rule condition, start typing in the relevant CONDITION field, then select an option from the pop-up to tell Teramind what type of value it is.

There are several conditions you can use. For example:

Use the Contains conditions for a partial text match. So, say you were searching for you then the Contains condition will detect any of these texts: YouTube, youtube.com, youth, layout since they all contain the text you.

An example use of this condition can be to block certain applications from running, you can type them in the CONDITION field and choose one of these conditions.

Note that, this condition isn’t case-sensitive. So, words like You, YOU, you – will have the same result.

Similar to the Contains condition but in this case, the text has to be an exact match. So, say you were searching for you then the Equals condition will NOT detect any of these texts: YouTube, youtube.com, youth, layout. However, it will detect You, YOU, you since they are exact matches even though the cases don’t match, and that doesn’t matter because the Equals condition isn’t case sensitive.

For complex matches, such as Credit Card Numbers, Social Security Numbers, etc., you can use the Match RegExp option. For example, the regular expression [a-zA-Z]{2}[0-9]{12} will detect any text that starts with 2 alphabet characters and ends with 12 digits such as, PO123456789123 or, ab123456789012.

This condition can be used in some specific cases, e.g., in File-based rules. It finds texts which follow a specific pattern or 'glob'.

The * glob will match zero or more characters. For example, the pattern, glob match *.exe in the File path criteria of a File-based rule will match all the executable files.

The ? glob will match exactly one character but you can also use more than one together. For example, glob match Sales????.doc will match “Sales2022.doc”, “SalesACME.doc”, “Sales23NA”, etc.

The special ** glob (called "globstar") can be used to detect any directories and subdirectories. This allows for recursive directory searching easily. Here’s an example:

The above rule with the glob match \Users\**\Documents\*.docx condition will detect any word document in paths like:

This is similar to the Contains condition but matches with any item on a Shared List. So, for example, if you had a shared list containing YouTube, youtube.com, youth, layout etc., then any text like, you, tube, You, Out, etc. will be detected.

This is similar to the Equals condition but will check for an exact match with any item on a Shared List. So, for example, if you had a shared list containing YouTube, youtube.com, youth, layout etc., then any text like, youtube, Youtube, YouTube will be detected. However, you, or tube, etc. will NOT be detected.

Rule logic binds two or more Conditions or Content Definitions together. So, they can be applied to both the rule Conditions and the Content Definitions.

Rule conditions can either have a ‘OR’ logic or an ‘AND’ logic.

You can see how the rule condition logics relate to each other on the Rule’s Summary panel.

When creating a Content Sharing rule and you have multiple content definitions, you can use logics to bind the definitions together. You can do so under the Advanced: Setup Logics section of the Content tab. Click on the logic between two conditions, a pop-up menu will appear where you can select a logic out of four options.

You can see how the content definition logics relate to each other on the Rule’s Summary panel:

The table below explains each type of logic and how they are evaluated:

On Teramind, you can assign risk levels to the rules. While optional, assigning risk levels has some advantages. It will let you analyze risk on the Risk Report, view risk trend and identify high risk users and rules.

There are two places you can assign risks:

You assign risk level to a regular rule from the Advanced Mode of the Rule Editor’s Actions tab. You can choose from: No Risk, Low, Moderate, High and Critical.

You can assign risk levels to each action block separately (you create action blocks by clicking the ADD THRESHOLD button).

Check out the Advanced Mode Actions section to learn more.

You assign risk level to an Anomaly rule Under its RULE RISK LEVEL section. You can choose from: No Risk, Low, Moderate, High and Critical. You can also turn on its ACCUMULATES RISK option on. If turned on, the risk associated with the rule will be counted multiple times for multiple violations. Otherwise it will be counted once for all violations.

Unlike the regular rules which support multilevel risk assignments, you can assign only one risk level per anomaly rule.

The right-most panel of the Rules Editor shows a summary of the rule in easy to follow language. You can see the values used in different tabs; what conditions are used and the logical connection among them; rule actions etc.

The Rules Editor is an intuitive, visual editor where you can create sophisticated threat detection, productivity optimization or data loss prevention rules easily without going through multiple screens or coding.

To access the Rules Editor, create a new rule or edit an existing rule from the Behavior > Policies menu.

You specify the basic settings for the rule on the Rules Editor’s General tab.

On the top fields, specify a Name and optionally, a Description for the rule.

You can also specify the rule’s Tags on this tab. Tags are keywords you can assign to a rule to easily identify it. They are useful in searching for the rule and can also be used as filters (i.e. on the Risk or Alerts report).

You can select the Rule Category and Types of Activities (for Activity-based rules) or the Types of Content (for Content Sharing rules) from the Rules Editor’s General tab.

There are three types of rule categories you can choose from: Agent Schedule, Activity and Content Sharing. Each category further supports different activities or content types. The table below shows which categories supports which activity/content types and their use cases:

Notes:

You specify the users for the rules on the Rules Editor’s User tab.

Here you specify which users, groups, departments or computers the rule will apply to. If you select a computer, the rule will apply to all the users on that computer.

By default, the rule will inherit the user settings from the policy the rule is a part of. However, you can turn off the INHERIT POLICY SETTINGS to select users manually.

You can specify who the rule will apply to and optionally, exclude anyone you don’t want to be included using the EXCLUDE FROM RULE field.

Check out the the Knowledge Base to learn how to add users/computers or add groups/departments.

After you have decided what type of rule you need and which users the rule will apply to, the next part is defining the detection criteria and scope. You will specify what, how or when the rule will be activated. You do this by selecting different parts of the selected Activity Type or Content Type. For example, the URL of the Webpage activity or the Application Name of the Clipboard content etc. You can then specify Condition Logics against the part(s) and the values you want to detect. Here’s how a detection criterion may look like:

You can specify the detection criteria for the Agent Schedule-based rules from the Schedule tab. Agent Schedule-based rules are the easiest to define as most of it deals with only one detection criterion, schedule/time.

The table below explains what criteria or schedule violation incidents the Agent Schedules supports and what conditions you can use with them.

Used to detect if there are any discrepancies in the employee’s daily work time. You can detect if their work hour is less than or more than specified hour(s).

Select either IS LESS THAN or IS GREATER THAN and enter an hour value in the SPECIFY VALUE field.

Used to detect if the employee is working longer or shorted than scheduled.

Select either IS SHORT BY or IS OVER BY and enter a minute value in the SPECIFY VALUE field.

Detects if the employee started their work earlier than scheduled, by specified minutes.

Enter a minute value in the DEFINE THE TIME RANGE field.

Detects if the employee ends their work earlier than scheduled, by specified minutes.

Enter a minute value in the DEFINE THE TIME RANGE field.

Detects if the employee ends their work later than scheduled, by specified minutes.

Enter a minute value in the DEFINE THE TIME RANGE field.

Detects if the employee starts their work later than scheduled, by specified minutes. Note that, unlike the ‘Is Late’ condition, this will trigger the rule after the employee has logged in.

Enter a minute value in the DEFINE THE TIME RANGE field.

Detects if the employee is absent.

No value is required.

Detects if the employee is late in logging in to their computer according to their scheduled start time. Note that, unlike the ‘Arrives Late’ condition, this will trigger the rule before the employee has logged in.

Enter a minute value in the DEFINE THE TIME RANGE field.

Detects if the employee is working on their day off.

No value is required.

Detects if the employee logs in during off hours and optionally also detects if they are trying to login from a restricted IP.

Set the off-hour range on the SETUP THE OFF-HOURS slider. You can click the + / – buttons to add/remove hours. Drag the slider Circles to adjust the hours.

You can restrict IPs from where the login is not permitted in the RESTRICTED IPS field. You can enter any text in the IPv4 format, i.e.: 101.10.2.1/32 and choose a ‘Equals’ or ‘Not Equals’ conditions. Or, you can select a Shared List (Network-based) and specify a ‘Match List’ or ‘Does Not Match’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

If you check the ‘Apply on screen unlock’ box, then the login event will be triggered when the user unlocks their screen. Click on the days under the EXCLUDE DAYS section to include/exclude days in the detection criterion.

Detects if the employee is idling (no keyboard or mouse activity) for more than specified minutes.

Enter a minute value in the DEFINE THE TIME RANGE field.

You can also set off-hours (breaks) by dragging the sliders under SETUP OFF-HOURS. The rule will be suspended during the off hours. Click the small – or + buttons to add as many breaks as you want.

You can specify the detection criteria for the Activity-based rules from their respective activity tab(s). For example, if you selected Webpages and Emails from the Type of Activity section (in the General tab), you will have two tabs called ‘Webpages’ and ‘Emails’ where you can add the rule conditions and values.

Webpages activity allows you to detect web browsing activities through URL, title and query arguments and browsing-related timing (i.e. idle/active).

The table below shows what criteria the Webpages activity supports and what conditions you can use with them.

Webpage URL

Any

Lets you detect if a webpage is visited.

Webpage URL

Used to detect an URL (webpage address) or part of an URL.

You can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

Webpage Title

Similar to the Webpage URL criterion, just use the webpage title instead.

Browser

Allows you to specify one or more browsers to detect. You can choose from the list of predefined browsers. You can also enter the browser’s process name (for example, enter msedge.exe for Microsoft Edge browser). See the notes* below for more information.

If you typed a browser name, you can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

You can exclude any browser(s) from the condition in the EXCEPT field.

Query Argument Name

A query argument name is the portion of a URL where data is passed to a website. It usually starts with a ‘?’ or ‘&’. For example: www.contacts.com/saved?company=teramind. Here, company is the query argument name.

Using this criterion, you can create interesting detection rules. For example, by checking for the composeargument in the Gmail website, you can detect if the user is composing an email. Combining this with the Webpage URL or Webpage Title criterion, you can detect more granular activities. For example, using the text new in the Webpage URL and specifying compose in the Query Argument Name, you can tell if a user is composing a new mail or editing an existing draft.

Private Mode

This criterion can be used to detect private/incognito/anonymous browsing.

Request Type*

This criterion allows you to further finetune when the rule action will trigger when the user visits an URL specified in the Webpage URL condition. It has two options:

Time Active

Used to detect how long the user has been active on the website.

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Time Idle

Similar to the Time Active criterion but detects how long the user has been idle/inactive on the site.

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Time Focused

Time Focused = Time Active + Time Idle.

It detects if the user stayed on a webpage for the specified duration. It doesn’t matter whether the user was active (e.g., keyboard/mouse is used) or idle (no keyboard/mouse activity); as long as they stayed on the webpage without switching to other webpages/tabs/windows, the condition will be triggered.

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Total Time Active

Similar to the Time Active criterion but detects the total time active (Total active time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Total Time Idle

Similar to the Time Idle criterion but detects the total time idle (Total idle time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and the ‘>=’ logic.

Total Time Focused

Similar to the Time Focused criterion but detects the total time focused (Total focused time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Applications activity allows you to detect the launch of any application including the ones run from the command line interface or through the Windows Run command.

The table below explains what criteria the Applications activity supports and what conditions you can use with them.

Any

Lets you detect if an application is launched.

Application Name

Used to detect the name or part of the name of an application. For example: ‘regedit.exe’.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Application Caption

Similar to the Application Name criterion, just use the application caption instead. For example: ‘Registry Editor’.

Launched from CLI

Detects if an application is launched from the CLI (Command Line Interface).

Select YES or NO.

Running elevated

Detects if an application is launched with elevated permission using Windows User Account Control (UAC).

An app is usually run as elevated when you launch it from the Windows Start menu while holding down the SHIFT+CTRL keys. Or, when you run it from the Windows Explorer with the right-click and then select the Run as administrator option. An application is also run elevated when it might make changes to the system (e.g., a software being installed for all users instead of just the current user). In such cases, Windows will invoke the UAC and the application will be considered as running elevated.

This criterion will help enhance the security of your system as software that usually requires admin permission might make changes to your system. It can also help you mitigate the impact of malware and prevent unauthorized privilege escalation, etc.

Select YES or NO.

Command Line Arguments

Command line arguments are additional parameters, options or values passed to an application when launching it from the CLI. They usually start with a ‘/’, ‘-‘ or a space after the application name. For example:

c:\ipconfig /renew. Here, renew is an argument.

Using this criterion, you can, for example, disable certain functions of an application. For example, in the second screenshot on the left, we blocked the launch of the ipconfig application when the release or renew arguments are used. Otherwise, it will run as usual. You can only use text value with the ‘Contains’, ‘RegExp’ or exact text match conditions for the CONDITION field.

Time Active

Used to detect how long the user has been active on an application.

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Time Idle

Similar to the Time Active criterion but detects how long the user has been idle/inactive on an application.

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Time Focused

Time Focused = Time Active + Time Idle.

It detects if the user stayed on an application for the specified duration. It doesn’t matter whether the user was active (e.g., keyboard/mouse is used) or idle (no keyboard/mouse activity); as long as they stayed on the app without switching to other apps, the condition will be triggered

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Total Time Active

Similar to the Time Active criterion but detects the total time active (Total active time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and use ‘>=’ logic.

Total Time Idle

Similar to the Time Idle criterion but detects the total time idle (Total idle time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

Total Time Focused

Similar to the Time Focused criterion but detects the total time focused (Total focused time accumulated in a day. The time will reset the next day.).

You can enter a minute value in the CONDITION field and use the ‘>=’ logic.

OS Version

Can be used to detect the name or part of the name of the operating system installed on the user's computer. For example: ‘Windows 10’, ‘Windows 11’, etc. As an example, you can use this criterion to block certain apps on Windows 10 but not on Windows 11.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any operating systems you do not want to track in the EXCEPT field.

The OCR detects on-screen text in real-time, even inside images or videos. It works with multi-screen setups, virtual desktops and terminal servers. By default, OCR detects English text. But you can also use few other languages (check out the Teramind Agent specifications and supported platforms article to learn which languages are supported).

You can change the OCR language from Monitoring Settings > OCR.

The table below shows what criteria the OCR supports and what conditions you can use with them.

On-Screen Text

Used to specify the text to detect on-screen.

You can choose from ‘Contains’, ‘Match regexp’, ‘Match list’ with any text as conditions. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can use the EXCEPT field to do detect any text except for the ones defined in this field.

Application Name

Used to specify the applications in which the OCR content will be detect.

You can choose from ‘Contains’, ‘Equals’ or ‘Equals List’ with any text as conditions. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Keystrokes activity is used to detect keystrokes entered by the users in applications or websites. In addition to regular keys, you can also detect the clipboard operations (copy/paste commands), use of special keys such as the Print Screen or multiple simultaneous keypress or combo keys such as CTRL+C.

The table below shows what criteria the Keystrokes activity supports and what conditions you can use with them.

Text Typed

Used to detect continuous text without any word break. For example, if text typed = “password”, the rule will be triggered when the last letter ‘d’ is typed.

You can enter any text in the CONDITION field and choose the ‘Contains’ or ‘Match RegExp’ option. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text you do not want to detect in the EXCEPT field.

Word Typed

Used to detect word typed with breaks. For example, if word typed = “password” the rule will be triggered when you finish typing the word and then type separation key, such as: <Space> or ‘!’ or ‘.’ (dot).

You can enter any text in the CONDITION field and choose the ‘Contains’, ‘Equals’ or ‘Match RegExp’ option. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any word you do not want to detect in the EXCEPT field.

Special Key Typed

You can detect special keys such as the function keys, (i.e. F1), PrtScr or key combinations such as <Shift+P>. When you select the Special Key Typed criteria and click on the CONDITION field, Teramind will pop-up a virtual keyboard where you can select the special keys.

Application Name

Specifies which applications will be tracked.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Webpage URL

Used to detect an URL (webpage address) or part of an URL.

You can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

Files activity lets you detect file operations such as access, read, write, upload, download, create folder, rename folder, etc. Each operation allows you to further specify additional detection criteria. For example, the Download operation lets you detect the program, file name, URL and file size.

Note that not all criteria are available for all file operations. Teramind will automatically show or hide the criteria based on which file operation you select. For example, if you select the Insert or the Eject operation, you will only see the Program and Drive criterion. Or, when you select the Copy or Move operation, you will see options to specify the source (e.g., Source file path, Source network host, Source drive, etc.).

Select a file operation by clicking the CONDITION filed. Click the Plus (+) button to add a criterion to the operation.

The table below describes the criteria you can use for the Files activity, and which file operations are supported for each criterion.

Program

Lets you specify in which program/app the file operation took place.

You can choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’.

Similarly, you can exclude any programs you do not want to track in the EXCEPT field.

Network Host

Used for network-based file operations. It detects the host name of the file operation. For example: http://sharepoint.com, ftp://filevault.net etc.

You can choose from ‘Contains’, ‘Equals’, ‘All Shares’. Or, you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any hosts you do not want to track in the EXCEPT field.

Source Network Host

Similar to the Network Host criteria but detects the source network host of a Copy or Move operation.

File Path

Used to detect a parent folder or file extensions. For example: document, c:\windows etc. File extension are used to identify a file type and usually starts with a ‘. (dot)’. For example: .doc, .pdf etc. Note: you do not need to specify the ‘.’ when entering the extension.

You can choose from various ‘Contains’, ‘Equals’, ‘Match’ conditions. When using one of the ‘match’ options, you can use a wildcard such as *, ?, [abc], [a-z], etc. For example, ?at will match Cat, cat, Bat or bat.

Source File Path

Similar to the File Path criteria but detects the source folder, file name or extension of a Copy or Move operation.

Drive

Detects the local, network or external drives.

You can enter a drive name (e.g., ‘c’) and select that particular drive or choose from ‘All Drives’ or ‘All External Drives’ conditions.

Source Drive

Similar to the Drive criteria but detects the source drive of a Copy or Move operation.

Cloud Provider

Used to detect the cloud provider.

You can choose from ‘All Cloud Providers’, ‘Dropbox’, ‘Google Drive’, ‘OneDrive’ or ‘Box’.

Similarly, you can exclude any providers you do not want to track in the EXCEPT field.

Source Cloud Provider

Similar to the Cloud Provider criteria but detects the source cloud provider of a Copy or Move operation.

RDP File Transfer

Detects if the file copy operation is done over an RDP (Remote Desktop Protocol) session. This happens when you connect to a remote computer and copy files to/from it.

You can select either YES or NO.

Download File Name

Lets you detect the download file name.

You can choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’.

Similarly, you can exclude any files you do not want to track in the EXCEPT field.

Download URL

Similar to the Download File Name criterion but used to detect the download URL instead.

Download File Size

Used to detect the size (in bytes) of the file being downloaded.

You can enter a byte value in the CONDITION field and use ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Upload File Name

Similar to the Download File Name criterion but used for Upload operation instead.

Upload URL

Similar to the Download URL criterion but used for the Upload operation instead.

Upload File Size

Similar to the Download File Size criterion but used for the Upload operation instead.

Upload Via

Lets you detect what kind of application or protocol is used for the upload operation.

You can choose from ‘FTP’, ’SMTP’, ‘Outlook’ or ‘Browser’.

Similarly, you can use the EXCEPT field to ignore any protocol/application you do not want to track.

Emails activity lets you detect outgoing and incoming emails including any email attachments.

The table below shows what criteria the Email activity supports and what conditions you can use with them.

Any

Lets you detect if an email is sent or received. If you use this option without any other criteria, Teramind will trigger the rule anytime an email is sent or received.

Mail Body

Used for detecting text inside the mail body.

You can choose from ‘Contains’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail Subject

Used for detecting text inside the mail subject.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail CC

Detects the CC addresses in an email.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail To

Similar to Mail CC criterion but used to detect the Mail To addresses instead.

Mail From

Similar to Mail CC and Mail To criterion but used to detect the Mail From addresses instead.

Mail Direction

Lets you detect if the mail is being sent or received.

Select either the INCOMING or OUTGOING option.

Mail Client

Used to specify the mail client you want to detect.

You can choose from ‘Gmail’, ‘Outlook Client’, ‘Outlook Web Client’, ‘Live.com’, ‘Yahoo Mail’, and ‘Yandex Mail’. Teramind keeps adding support for new clients so you might see more clients than mentioned here.

Similarly, you can exclude any client(s) you do not want to track in the EXCEPT field.

Has Attachments

Used to detect if the mail has any attachment.

Select either the YES or NO option.

Attachment Name

Used to detect the names or extensions for the attached files. A file extension is used to identify a file type and usually starts with a ‘. (dot)’. For example: .doc, .pdf etc. Note: you do not need to specify the ‘.’ when entering the extension.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can check for file extensions using one of the ‘Extension Contains’, ‘Extension Equals’, ‘Extension Does Not Contain’ options.

Mail Size

Used to detect the size (in bytes) of the mail.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

IM activity lets you detect instant messaging conversations and group chats for popular IMs such as: Skype, Slack etc. You can detect both incoming and outgoing messages, detect the participants and search the message body for keywords or text.

The table below shows what criteria the IM activity supports and what conditions you can use with them.

Any

Lets you detect if an IM is sent or received.

Message Body

Used for detecting text inside the message body.

You can choose from ‘Contains’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Message Direction

Lets you detect if the message is being sent or received.

Select either the INCOMING or OUTGOING option.

Messaging App

Used to specify the messaging app you want to detect.

You can choose from ‘Facebook, ‘Skype Web’, ‘Skype for Business’, ‘LinkedIn’, ‘Google Hangouts’, ‘WhatsApp Web’, ‘Slack Web’, ‘Slack’, ‘Microsoft Team Web’ and ‘Microsoft Team’. Teramind keeps adding support for new apps so you might see more clients than mentioned here.

Similarly, you can exclude any app(s) you do not want to track in the EXCEPT field.

Contact Name

Used to detect the contacts/participants of the IM conversation.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any contacts you do not want to track in the EXCEPT field.

Browser Plugins activity lets you detect any installed browser, plugins or extensions, what they are doing or what data they are accessing.

The table below shows what criteria the Browser Plugins activity supports and what conditions you can use with them.

Any

Lets you detect if a browser is launched/activated.

Browser

Used to specify the browser you want to detect.

You can choose from ‘Chrome’, ‘Opera’, ‘Firefox’, ‘Internet Explorer’ or ‘All Browsers’. Teramind keeps adding support for new browsers so you might see more clients than mentioned here.

Similarly, you can exclude any client(s) you do not want to track in the EXCEPT field.

Plugin Permissions

You can detect what permissions the plugin is using.

You can choose from any of these conditions:

Similarly, you can exclude any permission you do not want to track in the EXCEPT field.

The Printing activity lets you detect print jobs across local or network printers. You can use criteria, such as: the document and printer and number of pages being printed.

The table below shows what criteria the Printing activity supports and what conditions you can use with them.

Any

Lets you detect if any print job is sent to the printer.

Document Name

Used to specify the document names you want to detect.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any plugins you do not want to track in the EXCEPT field.

Printer Name

Used to specify the printers you want to track.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any plugins you do not want to track in the EXCEPT field.

Number of Pages

Used to detect the number of pages of the document being printed.

You can enter a page value in the CONDITION field and use the ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

The Network activity lets you detect network activities using criteria such as the applications using the network, byte sent/received, remote host etc..

The table below explains what criteria the Network activity supports and what conditions you can use with them.

Application Name

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Remote Host

Used to specify the network the remote host is connected to.

You can enter a host address (such as: google.com) or an IP address (such as: 10.52.22.1/32) in the CONDITION field or you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any host you do not want to track in the EXCEPT field.

Remote Port

Used to detect the port of the network connection.

You can enter a port value in the CONDITION field and use the ‘=’ logic.

Similarly, you can use the EXCEPT field to specify an exception.

Bytes Sent

Used to specify the number of bytes sent over the network connection.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’ or the ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Bytes Received

Used to specify the number of bytes received over the network connection.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’ or the ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Local IP

Used to detect local IP addresses.

You can enter an IP address (such as: 182.178.1.2/32) in the CONDITION field or you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any IP you do not want to track in the EXCEPT field.

The Registry-based activity rules let you detect changes to the registry. You can detect registry key, name, value/data and program.

Windows Registry Editor

The table below explains what criteria the Registry activity supports and what conditions you can use with them.

Key

You can enter any text in the CONDITION field and choose from ‘Contains’ or ‘Equals’ conditions. Or, you can select the ‘Match glob’ condition and use wildcards such as *, ?, [abc], [a-z], etc. For example, ?at will match Cat, cat, Bat or bat.

Similarly, you can exclude any key you do not want to track in the EXCEPT field.

Note that actual registry keys differ from what it looks like in the Windows Registry Editor.

For example, \registry\machine key is represented as Computer\HKEY_LOCAL_MACHINE on the Registry Editor. Or, the \registry\users represented as Computer\HKEY_USERS.

Teramind will use the actual keys to match the conditions instead of what’s shown on the Windows Registry. For convenience if string condition for the key starts with one of the following, it will be recoded for the actual search accordingly:

Name

Used to specify the name of a registry value. For example, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR key may contain a value called “Start”.

You can enter any text in the CONDITION field and choose from ‘Contains’ or ‘Equals’ conditions. Or, you can select the ‘Match glob’ condition and use wildcards such as *, ?, [abc], [a-z], etc. For example, ?at will match Cat, cat, Bat or bat.

Similarly, you can exclude any name you do not want to track in the EXCEPT field.

Value

Used to detect the value of a registry name. Windows registry value can contain a String, Multi-String, Binary, etc. So, enter a value accordingly.

You can enter any text in the CONDITION field and choose from ‘Contains’ or ‘Equals’ conditions. Or, you can select the ‘Match glob’ condition and use wildcards such as *, ?, [abc], [a-z], etc. For example, ?at will match Cat, cat, Bat or bat.

Similarly, you can exclude any name you do not want to track in the EXCEPT field.

Program

Can help identify which application or service is responsible for making the registry changes.

You can enter any text in the CONDITION field and choose from ‘Contains’ or ‘Equals’ conditions. Or, you can select the ‘Match glob’ condition and use wildcards such as *, ?, [abc], [a-z], etc. For example, ?at will match Cat, cat, Bat or bat.

Similarly, you can exclude any name you do not want to track in the EXCEPT field.

The Camera Usage-based activity rule lets you detect when a camera/webcam is used. You can detect the camera name and the application in which the camera is being used.

The table below explains what criteria the Camera Usage activity supports and what conditions you can use with them.

Any

Lets you detect if any camera is turned on in any application.

Camera Name

Used to specify the camera you want to detect. Note: you can find the name of all the available cameras (built-in or external) on the Windows Device Manager, under Cameras.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any camera you do not want to track in the EXCEPT field.

Camera Application Name

Used to specify the application using the camera.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Windows events are all the activities tracked by the OS. These include Applications, System, Security, Hardware, etc. You can see these events on the Windows Event Viewer:

The ability to detect these events is a very powerful tool, because it allows an administrator to identify issues with the computer, discover security gaps and stop potential threats.

The Windows Log Event rule allows you to detect these Windows events.

The Windows Log Event activity comes with only one criterion:

Event ID

Lets you specify one or more Windows event IDs.

You can enter numeric values in the CONDITION field and use the ‘=’, ‘>’, the ‘>=’, ‘<’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Content Sharing rules are used to detect content or text inside an object. The object can be a file, an email or IM chat, data in the clipboard or even any text displayed on the screen. You can use these powerful rules to prevent data exfiltration attempts, such as: block transferring of a file when it contains credit card numbers; warn a user when they attempt to send emails containing sensitive keywords etc.

You can specify the detection criteria for the Content Sharing rules in two places:

This tab allows you to define what makes the content sensitive and specify the values to look for. You need to select at least one Types of Content, such as: Clipboard, File etc. to be able to use the Content tab.

You can select from different data definitions depending on what Types of Content you have selected in the General tab (i.e. Clipboard, Files, Emails, IM).

For example, if you have selected the Clipboard content type, then you will see the ‘Clipboard Origin’ in the data definition list.

The table below shows what criteria the Content definition supports and what conditions you can use with them.

Data Content is a generic criterion that can be used to look for any text or binary data. For example, by using it with the Clipboard, you can detect anything copied on the clipboard.

You can select TEXT, BINARY or BOTH as the CONTENT TYPE.

For SELECT MATCH TYPE, you can choose ‘Contains’, ‘Equals’ or ‘RegExp’ and specify the text or binary values in the bottom field. Use the + button to add multiple values. Or, you can choose ‘Match List Member’ or ‘Equals List Member’ as a match type and then select a Shared List (Text-based or Regular Expressions-based) from the SELECT SHARED LIST drop-down menu. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Clipboard Origin detects data pasted into the clipboard from a specific webpage or application. By using it you can, for example, build a rule that prevents copy pasting of customer data from your CRM site.

You can select WEBPAGE or APPLICATION as the source of the clipboard copy operation.

For SELECT MATCH TYPE, you can choose ‘Contains’, ‘Equals’ or ‘RegExp’ and specify the text values in the bottom field. Use the + button to add multiple values. Or, you can choose ‘Match List Member’ or ‘Equals List Member’ as a match type and then select a Shared List (Text-based or Regular Expressions-based) from the SELECT URL or SELECT NAME drop-down menu. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

File Origin detects file sharing based on its origin or source. It supports local, Cloud and web sharing. By using it you can, for example, build a rule that prevents sharing of files to Cloud drives.

You can select from several sharing options under the SELECT FILE ORIGIN section. SHARE = any type of network shares, CLOUD = sharing over Cloud services, such as, Dropbox and URL = sharing over any websites.

Depending on which origin (SHARE / CLOUD / URL) you selected, you can choose from ‘All Share’, ‘Contains’, ‘Equals’ or ‘RegExp’ in the SELECT MATCH TYPE field and specify the text values in the bottom field. Use the + button to add multiple values. Or, if available, you can choose the ‘Match List Member’ or ‘Equals List Member’ as a match type and then select a Shared List (Network-based) from the SELECT URL or SELECT NAME drop-down menu. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

File Properties detect files based on their meta-tags (also know as ‘file property’ or ‘field’). By using it you can, for example, build a rule that prevents sharing of any documents outside your company that has has a specific property/field containing a specific value. For example, a 'Restricted' field/property with the string value 'Yes'.

To use this criterion, first create the rule:

1. Select a FIELD TYPE such as: ANY, STRING, INTEGER or DATE.

2. Select MATCH TYPE for the condition. If you have selected the STRING field type, you can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ options. Use the + button to add multiple values. Or, you can choose the ‘Match List Member’ or ‘Equals List Member’ as a match type and then select a Shared List from the SELECT URL or SELECT NAME drop-down menu. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists. If you chose INTEGER or DATE field type, you can choose one of the ‘=’, ‘>’, ‘<’ logics.

3. Enter the name of the file property the rule will detect in the FIELD NAME field.

4. Specify the value the file property should contain in the SPECIFY VALUE field.

After you have created the rule, you can now add Custom tag(s) in the file(s) you want the rule to detect. You can create a custom tag from the Office apps such as Word, Excel, PowerPoint etc. Here's an example showing how to create a custom tag in Microsoft Word:

1. Click File > Info

2. Click on Properties on the right-panel and select Advanced Properties:

3. Click the Custom tab and enter a Name, Type and Value for the property. Click the Add button when done:

4. Save the document.

Predefined Classified Data detects content based on predefined data categories.

There are several types of data categories you can choose from: Financial Data, Health Data, Personally Identifiable Data etc.

The SENSITIVE DATA TO DETECT field will have different menu options depending on what you choose in the SELECT SENSITIVE DATA CATEGORY field. For example, if you choose Financial Data in the previous field, you can choose from ‘All credit card numbers’, ‘SWIFT code’ etc. Or, if you choose the Health Data, you can choose from ‘Common drug names’, ’DNA profile’ etc.

If you choose the Financial Data from the SELECT SENSITIVE DATA CATEGORY field, then you will see an option: CREDIT CARD DETECTION MODE. This option will let you select the sensitivity of the algorithm to detect credit card numbers. For more information, see the notes under Adjust the Sensitivity of Credit Card Detection below.

Finally, you can specify how often a data pattern can appear in the content before the rule is triggered in the TRIGGER ON PATTERN… field.

Check out the List of Predefined Classified Data article for a list of all the predefined classified data supported in Teramind.

The Clipboard content type detects text copied to the clipboard from any applications or websites.

The table below shows what criteria the Clipboard supports and what conditions you can use with them.

Any

Lets you detect the clipboard text in any applications or websites.

Application Name

Used to specify the applications in which the Clipboard action will be detected.

You can choose from ‘Contains’, ‘Equals’ or ‘Equals List’ with any text as conditions. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or 'Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Webpage URL

Used to specify the webpage URL (website address) in which the Clipboard action will be detect.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

Files content type works in the same way as it does in the Files Activity rules. However, there are certain file operations that you cannot use in the Content Sharing rules. For example, the Download operation or none of the folder operations are supported.

Note that not all criteria are available for all file operations. Teramind will automatically show or hide the criteria based on which file operation you select. So, if you select the Access or the Delete operation, you will only see the Program criterion. Some file operation may have additional detection criteria. For example, the Upload operation lets you specify the Upload URL.

Select a file operation by clicking the CONDITION filed.

Click the Plus (+) button to add a criterion to the operation.

If you choose the ‘Any’ file operation without any other criteria, Teramind will trigger the rule for any file operation where the content is detected.

The table below describes the criteria you can use for the Files sharing rules, and which file operations are supported for each criterion.

Program

Lets you specify in which program/app the file operation took place.

You can choose from ‘Contains’, ‘Equals’, ‘Match RegExp’ or ‘Match Glob’.

Similarly, you can exclude any programs you do not want to track in the EXCEPT field.

Network Host

Used for network-based file operations. Detects the host name of the file operation. For example: http://sharepoint.com, ftp://filevault.net etc.

You can choose from ‘Contains’, ‘Equals’, ‘All Shares’. Or, you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any hosts you do not want to track in the EXCEPT field.

Drive

Detects the local, network or external drives.

You can enter a drive name (e.g., ‘c’) and select that particular drive or choose from ‘All Drives’ or ‘All External Drives’ conditions.

File Path

Used to detect a file path. For example: \windows\system32\.

You can only choose the ‘Starts with’, condition with any path you enter.

Cloud Provider

Used to detect cloud providers.

You can choose from ‘All Cloud Providers’, ‘Dropbox’, ‘Google Drive’, ‘OneDrive’ or ‘Box’, etc.

Similarly, you can exclude any provider you do not want to track in the EXCEPT field.

RDP File Transfer

Detects if the file copy operation is done over an RDP (Remote Desktop Protocol) session. This happens when you connect to a remote computer and copy files to/from it.

You can select either YES or NO.

Upload URL

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs you do not want to track in the EXCEPT field.

External Drive

You do not need to specify any conditions in this criterion.

Emails content type works in the same way as it does in the Email Activity rules. Except, the Mail Body criterion is not supported.

Emails lets you detect content sharing over outgoing and incoming emails, draft emails* and email attachments.

The table below shows what criteria the Emails sharing supports and what conditions you can use with them.

Any

Lets you detect if an email is sent or received.

Mail Subject

Used for detecting text inside the mail subject.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail CC

Detects the CC addresses in an email.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail To

Similar to Mail CC criterion but used to detect the Mail To addresses instead.

Mail From

Similar to Mail CC and Mail To criterion but used to detect the Mail From addresses instead.

Mail Direction

Lets you detect if the mail is being sent or received.

Select either the INCOMING or OUTGOING option.

Mail Client

Used to specify the mail client you want to detect.

You can choose from ‘Gmail’, ‘Outlook Client’, ‘Outlook Web Client’, ‘Live.com’, ‘Yahoo Mail’, and ‘Yandex Mail’. Teramind keeps adding support for new clients so you might see more clients than mentioned here.

Similarly, you can exclude any client(s) you do not want to track in the EXCEPT field.

Has Attachments

Used to detect if the mail has any attachment.

Select either the YES or NO option.

Attachment Name

Used to detect the names or extensions for the attached files. File extension are used to identify a file type and usually starts with a ‘. (dot)’. For example: .doc, .pdf etc. Note: you do not need to specify the ‘.’ when entering the extension.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can check for file extensions using one of the ‘Extension Contains’, ‘Extension Equals’, ‘Extension Does Not Contain’ options.

Mail Size

Used to detect the size (in bytes) of the mail.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

IM content type works in the same way as it does in the IM Activity rules. Except, the Message Body criterion is not supported.

IM lets you detect content sharing over instant messaging conversations and group chats for popular IMs such as: Skype, Slack etc. You can detect both incoming and outgoing messages, detect the participants and search in the message body for keywords or text.

The table below shows what criteria the IM sharing supports and what conditions you can use with them.

Any

Lets you detect if an IM is sent or received.

Message Direction

Lets you detect if the message is being sent or received.

Select either the INCOMING or OUTGOING option.

Messaging App

Used to specify the messaging app you want to detect.

You can choose from ‘Facebook, ‘Skype Web’, ‘Skype for Business’, ‘LinkedIn’, ‘Google Hangouts’, ‘WhatsApp Web’, ‘Slack Web’, ‘Slack’, ‘Microsoft Team Web’ and ‘Microsoft Team’. Teramind keeps adding support for new apps so you might see more clients than mentioned here.

Similarly, you can exclude any app(s) you do not want to track in the EXCEPT field.

Contact Name

Used to detect the contacts/participants of the IM conversation.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any contacts you do not want to track in the EXCEPT field.

A Keystrokes Content Sharing rule works similarly to the Keystrokes Activity rule. Except, it also comes with the Content tab with support for the Data Content and Predefined Classified Data definitions. This allows you to detect two sets of specialized contents easily.

The table below shows what criteria the Keystrokes content sharing rules supports and what conditions you can use with them.

Text Typed

Used to detect continuous text without any word break. For example, if text typed = “password”, the rule will be triggered when the last letter ‘d’ is typed.

You can enter any text in the CONDITION field and choose the ‘Contains’ or ‘Match RegExp’ option. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text you do not want to detect in the EXCEPT field.

Word Typed

Used to detect word typed with breaks. For example, if word typed = “password” the rule will be triggered when you finish typing the word and then type separation key, such as: <Space> or ‘!’ or ‘.’ (dot).

You can enter any text in the CONDITION field and choose the ‘Contains’ option. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any word you do not want to detect in the EXCEPT field.

Special Key Typed

You can detect special keys such as the function keys, (i.e. F1), PrtScr or key combinations such as <Shift+P>. When you select the Special Key Typed criteria and click on the CONDITION field, Teramind will pop-up a virtual keyboard where you can select the special keys.

Application Name

Specifies which applications will be tracked.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Webpage URL

Used to detect an URL (webpage address) or part of an URL.

You can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

Anomaly rules are special types of rules that allow you to identify anomalies in a user’s behavior by utilizing behavioral baselines. It also allows you to assign risk levels to any anomalous behavior and a notification action to inform admins or managers about the anomaly.

The Anomaly Rules Editor is an intuitive, visual editor where you can create sophisticated behavioral-anomaly rules on a single screen.

To access the Anomaly Rules Editor, create a new anomaly rule or edit an existing rule from the Behavior > Anomaly rules menu.

Check out the Anomaly Rules section on the Teramind User Guide to learn more about creating / editing anomaly rules, managing anomaly rule templates etc.

You specify the basic settings for an anomaly rule on the Anomaly Rules Editor’s General Settings section.

You can specify a name for the rule in the RULE NAME field. You can select which users, groups, departments or computers the rule will apply to in the APPLIES TO field. If you select a computer, the rule will apply to all the users on that computer. Optionally, you can exclude anyone you don’t want to be included using the EXCLUDING field. You can also specify the rule’s tags in the TAGS field. Tags are keywords you can assign to a rule to easily identify it. They are useful in searching for the rule and can also be used as filters on various reports (i.e. Risk or Alerts report).

You define the detection criteria under the RULE TRIGGER section of the Anomaly Rules Editor.

You can select an action that will trigger the rule and then specify the conditions to evaluate. There are several types of actions you can choose from: Applications, Websites, Emails, Activity, Files, Network etc.

Each action has different conditions you can select from, such as: Time, Name, Anomaly Baseline etc. After you have selected a condition, you can choose a logic, such as: ‘>’, ‘<’, ‘Equals’ etc. from the middle field. Finally, you specify value(s) to detect in the right-most field.

You can add multiple conditions to an action by clicking the ADD CONDITION button. For example, you can create an anomaly rule using the URL condition and a Time condition with a Websites action to detect if a user spent >20% in ‘youtube.com’.

In the next few sections, we will walk you through all the available options for setting detection criteria for each action type.

Time

Detects time spent (%) in an application or website.

Enter a percent value and use the ‘>’ or ‘>=’ logic for the condition.

This condition is only supported in the Applications and Webpages actions.

Name

Used to specify a name for an application.

Enter a text value and use the ‘Equals’, ‘Contains’, ‘Does Not Contain’ ‘Regular Expression Match’, or ‘Regular Expression Not Match’ logic for the condition.

This condition is only supported in the Applications action.

URL

Used to detect the URL of a webpage.

Enter a text value and use the ‘Equals’, ‘Contains’, ‘Does Not Contain’ ‘Regular Expression Match’, or ‘Regular Expression Not Match’ logic for the condition.

This condition is only supported in the Webpages action.

Productivity

Detects the productivity level (in percent) of a user. To learn more about how productivity is measured in Teramind, check out this article, Productivity Metrics: How is Work Time / Idle Time / Activity Percentage / Productive Time / Unproductive Time / Total Time determined?. For more information on productivity reports, check out the BI Reports > Productivity section on the Teramind User Guide.

Enter a percent value and use the ‘<’, ‘>’ or ‘>=’ logic for the condition.

This condition is only supported in the Activity: Productivity action.

Rate

Detects the idle rate (in percent) of a user. To learn how idle time and other productivity metrics are measured in Teramind, check out this article, Productivity Metrics: How is Work Time / Idle Time / Activity Percentage / Productive Time / Unproductive Time / Total Time determined?. For more information on productivity reports, check out the BI Reports > Productivity section on the Teramind User Guide.

Enter a percent value and use the ‘>’ or ‘>=’ logic for the condition.

This condition is only supported in the Activity: Idle Rate action.

Size

Detects the size (in Mega Bytes) of data in a network operation.

Enter a value in Mega Bytes and use the ‘>’ or ‘>=’ logic for the condition.

This condition is only supported in the Network: Data In and Network: Data Out actions.

Anomaly Baseline

Anomaly Baseline uses algorithm to determine if certain user behavior is outside a baseline. This can be the user’s current behavior compared to their past behavior; an employee’s behavior compared to their departmental baseline; or an employee’s behavior compared to the baseline of the entire organization. Using a baseline lets you, for example, set an anomaly rule to notify you when a user uploads an unusual number of files than they normally do in a day-to-day basis.

A special formula is used to check for anomaly baseline. The formula is:

The Current Activity Value is the amount of activity. For example, the number of File Uploads by a user. The score is measured automatically every hour to determine if it crossed the baseline. The default value of this is 3.5.

As an example, consider a user uploaded [1, 2, 3, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 30] times every day for 15 days. And on the 16th day, the uploaded for 80 times.

In this case, their anomaly score will be:

3.62 = (80-8.125) / 19.82

Which is greater than the default value of 3.5. So, this means the user exceeded the anomaly baseline on the 16th day.

The anomaly baseline can be applied to a user’s own activities (Self), the activities compared to a department (Department) or the entire organization. If you choose anything other than Self, then the Anomaly Score of the user activities will be compared against the Score of the Department/Organization for the same period.

Threshold Count

The anomaly threshold is like the threshold value available in a regular rule action (Advanced Mode). It will trigger the rule action if the total count of Anomaly Baseline violation crosses the set number of threshold.

For example:

If you set the threshold to >0 then the rule will be triggered immediately (as soon as the anomaly baseline crosses the first time). As an example, consider a user uploaded [1, 2, 3, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 30] times every day for 15 days. And on the 16th day, the uploaded for 80 times. In this case, the user will cross the Anomaly Baseline on the 16th day (see Anomaly Baseline above). And as soon as the baseline is crossed, the rule action will be triggered.

However, say, you set the threshold to >1 then the baseline has to be crossed twice before the rule action is triggered. In the above example, if the user keeps uploading the file at the similar rate, the rule action will be triggered in about 32 days or so.

Note that, anomaly threshold works for a user’s own activities (Self) and not for any department or entire organization.

This condition is supported in all actions except for Applications and Webpages.

Actions let you specify what the system will do when a rule is violated. You can warn a user or block them, receive notification, record a video of the desktop etc.

You can assign actions to a rule from the Actions tab on the Rules Editor for regular rules. Or, from the RULE ACTIONS section on the Anomaly Rules.

Note that, not all rule categories support all actions. For example, the Agent Schedule only supports the NOTIFY action for most of its schedule violation types except for the Login and Idle activities. Same way, different Types of Activity / Types of Content may also have their own special actions. For example, Webpages have an action called REDIRECT which is not available for other activity. Also, not all actions are available on all the operation systems. For example, the COMMAND action does not work on the macOS at the moment.

In some cases, you can use multiple actions as long as they do not conflict with each other. For example, you can use the NOTIFY and BLOCK actions together as they do different things. But you cannot use the BLOCK and LOCK OUT USER actions together because they both prevent the user from completing an activity. The Rules Editor will automatically disable actions that conflict with the currently selected action(s).

There are two ways you can setup actions: Simple Mode and Advanced Mode.

Simple Mode is the easiest way to create rules and is recommended for beginners. In the Simple Mode, you can specify actions, but you cannot set any risk thresholds.

Here are the actions you can use:

Teramind will send an email notification to the specified email accounts whenever any user violates the rule. You can manage how such notification emails are handled from the Settings > Alerts screen (ALERT EMAILS LIMIT option).

Blocks the user activity and shows a message*. You can use a HTML template to display the message. See the Customizing the HTML Alert Template article to learn more.

You can also specify how long Teramind should wait between multiple alert messages that the user sees. The setting can be found under Settings > Alerts screen (USER ALERTS THRESHOLD option).

Shows a warning message to the user and then when they press the OK button, they are locked out of the system. If the user logs back in, they will be logged out automatically. An administrator will have to unlock the user for them to be able login again. Check out the Employee Action Menu section on the Teramind User Guide for more information on unlocking a user.

Redirects the user to a different website when they try to access certain URL(s).

Warns a user with a message. Similar to the message in the Block action, you can use a HTML template to display the warning message.

You can specify how long Teramind should wait between multiple alert messages that the user sees. The setting can be found under Settings > Alerts screen (USER ALERTS THRESHOLD option).

You can automatically assign the user a task based on their activities.

You can specify how long Teramind will wait before assigning a new task to a user. The setting can be found under Settings > Alerts screen (RULE TASK SELECTION ACTION TIMEOUT option).

If video recording is disabled in your Screen monitoring settings, you can still record a video of the rule violation incident with this action. The system will automatically record for the specified number of minutes before and after the incident.

With this action, you can execute a Windows command automatically when a rule is violated.

This is a powerful action as it allows you to run any application or script on the user’s computer. For example, you can force shutdown the pc (shutdown /s /f /t 0), kill a task (taskkill -im ixplore.exe) and do much more.

In the Advanced Mode, you can specify risk thresholds for a rule. You can add multiple thresholds, assign risk levels and take different actions depending on how often the rule is violated. For example, you can set an email rule that sets a Low risk and a Warn action when a user sends 5 emails in a day. However, if they send more than 10 emails a day, then set a Moderate risk level and trigger a Notification action.

The risk levels that you assign in the Advanced Mode are used by Teramind to calculate risk scores (see the Using the Risk Report section to learn more about risk analysis) and can also be used to filter other reports (e.g., BI Reports > Behavior Alerts).

1. You can choose the time period for the thresholds such as Hourly, Daily, Monthly etc.

2. Select/enter the maximum number of alerts that can be triggered for this rule in a day. If more than the specified number of alerts are triggered for this rule in a single day, Teramind will not save further alerts and the alerts will not appear on the BI Reports > Behavior Alerts or other alert logs. If you leave the field empty or use an invalid value (entering a string, a negative number, etc.) then no daily limit will be applied. If you set it to 0, then no alerts for the rule will be generated (the rule will still trigger). Note that, you can set the global maximum alerts per alert type in the Settings > Alerts > MAXIMUM DAILY ALERTS COUNT field.

3. The threshold slider lets you adjust the frequency once you have added one or more thresholds. Note that, each small orange dots on the slider is connected to a Frequency field of an action. Changing one will update the other.

4. Click the ADD THRESHOLD button to add new threshold (actions). For example, in the picture above, we added two actions (action 1 and action 2). For each threshold, you can set frequency, risk level and action. Note that, the actions (e.g., Notify, Warn) are same as the Simple Mode actions.

5. You can use the Frequency field to set a frequency.

6. Use the Define a risk level field to set a risk level. You can choose from: No Risk, Low, Moderate, High or Critical.

7. Use the small + button (under the Choose an action text) to add an action.

When you create a new rule, by default it’s automatically turned on. You can edit a rule even when it’s running. Any changes you make to the rule will be enforced immediately if the user is online and connected to the Teramind server or as soon as they connect.

Rules are enforced depending on what type of Teramind Agent is installed on the user’s computer:

If the user is using a Stealth Agent:

If the user is using a Revealed Agent:

You can manually turn a rule on/off from the Teramind Dashboard. To do so:

You can manually control the rules from the Behavior Policies screen. To access the Behavior Policies screen, click the BEHAVIOR > Policies menu.

Use the ON/OFF button next to a rule’s name to turn it on or off. You can also use the ON/OFF button next to the Policy’s name for which the rule is a part of. If you turn off the policy, all rules under the policy will be deactivated even if the individual rules are turned on. If the policy is turned on, the rules that has the ON status will be activated and the OFF rules will remain inactive.

The only way to turn off an anomaly rule is to remove it from the Anomaly rules screen. To access the Anomaly rules screen, click the BEHAVIOR > Anomaly rules menu.

Click the X button besides an anomaly rule to remove it.

Alerts tab allows you to define how rule violation messages will be displayed to the users. It’s a good idea to customize your alert messages so that they are visually distinctive and match with you company’s branding.

You can find more information alert customization and step by step instruction on this article: How to customize alert messages with the HTML template.

When creating a new rule, you can choose from a list of pre-built templates. Click the CHOOSE A TEMPLATE pull-down menu to choose a template on the Rules Editor’s General tab:

Teramind has many templates for Data Loss Prevention, Email, Applications, Websites, File Operations etc. Once you select a template, the rest of the rule’s tabs will be automatically populated with pre-configured settings and sample data. You can, of course, change them to meet your needs.

Check out the List of Prebuilt Rule Templates articles for a list of all the prebuilt regular rule templates available in Teramind.

When creating a new anomaly rule, you can choose from a list of pre-built templates. Click the USE TEMPLATE button, then choose a template from the TEMPLATE TO USE pull-down menu to choose a template:

Teramind comes with many anomaly rules templates. You can choose from a list of types such as: Applications, Emails, File Operations etc.

Check out the List of Prebuilt Anomaly Rule Templates article for a list of all the prebuilt anomaly rule templates available in Teramind.

There are multiple ways you can investigate rule violation incidents on Teramind.

This is your primary source to view all rule violation incidents. You can use the Alerts report to view a list of rule violation incidents with all the necessary details, such as: the date/time the incident happened, the user or activity involved and other pertinent information. You can also view a session recording of an alert, export the alerts report or schedule it for auto delivery to selected email addresses.

You can access the Alerts report from the BI Reports > Behavior Alerts menu, under the Basic tab.

For more information on the Alerts report and to learn how to use its different features, check out the BI Reports > Behavior Alerts section on the Teramind User Guide.

On the Behavior Alerts screen, you will see a table/grid widget. If you right-click on row, you will see a pop-up menu:

1. Click the Investigate option from the pop-up menu to view the Employee’s Activity Monitoring Report From that report, you can see all the alerts for the employee under the Alerts tab.

2. Click the View record option to view the Session Recording of the employee at the selected timestamp.

You can also add an Alerts Log widget to your dashboard. The widget allows you to view the most recent alerts in real-time or for the selected date range. You can add the Alerts Log widget to a dashboard by clicking the ADD WIDGETS button on the Dashboard’s screen.

For more information on the Widgets and to learn how to use them, check out the Dashboard Widgets sections on the Teramind User Guide.

Session Player allows you to view a user’s desktop in live view or history playback mode. You can precisely locate when a rule violation incident occurred, check out all the alert notifications the user received and investigate the trail of user activities leading up to the incident. If the user is online, you can take remote control of their computer or freeze their inputs to prevent further incidents.

If Audio recording is enabled, you can also hear recordings of both sound outputs and inputs (speakers/line-out, microphone/line-in). Finally, you can take snapshots of the user’s desktop, forward the recordings to select email addresses or download them as MP4 files.

You can access the Session Player from the BI Reports, from the Employee’s Activity Monitoring Report or even from the Dashboards. Click the Movie Camera icon, wherever you see it, to access the Session Player.

For more information on the Session Player and to learn how to use its different features, check out the Session Player section on the Teramind User Guide.

The Risk report allows you to analyze the impact of rule violation incidents and the risks they pose to your organization. The report shows top risky rules, users, applications and websites. You can drill-down each risk category to further investigate what caused the risk level to change. You can also plot the risk trend by department, severity, number of violations, tag etc. Unique risk scores help you identify high-risk rules or users so that plans can be developed for treating the risks.

You can access the Alerts report from the BI Reports > Behavior Alerts menu, under the Risk tab.

For more information on the Risk report and to learn how to use its different features, check out the BI Reports > Behavior Alerts section on the Teramind User Guide.

You can also add a Risk widget to your dashboard. The widget allows you to view the most recent risk trend and risk scores for users, activities or rules in real-time or for the selected date range. You can add the Risk widget to a dashboard by clicking the ADD WIDGETS button on the Dashboard’s screen.

For more information on the Widgets and to learn how to use them, check out the Dashboard Widgets sections on the Teramind User Guide.

You can use the OMNI dashboard to have a snapshot view of the most critical insights and incidents about your organization in a social media-like interface. You can view behavior alerts and drill down to investigate what activity caused the rule to trigger.

OMNI also features machine learning based threat detection and abnormalities identification. To learn more about OMNI, please check out the OMNI section on Teramind User Guide.
​

This example shows how you can create an Agent Schedule rule to detect a user attempting to login during off hours.

General Tab

On the first tab, General, we assigned a name.

We have chosen an Agent Schedule rule type under the Rules Category since we are looking to detect a user’s login time.

To learn more:

User Tab

For the users, we choose to manually add the users (by turning off the INHERIT POLICY SETTINGS).

We also decided to apply this rule to external contractors only. To do so, we first created a department named ‘External Contractors’ and then edited the selected users’ profiles to assign them to this department.

To learn more:

Schedule Tab

We have selected the Login schedule violation type so that we can monitor the login attempts.

We have also setup two time slots that will be considered as off-hours (12am-8am and 6pm-12am). Any attempt to login in these two periods will trigger the rule.

If you wanted, you could setup additional options such as restricted IPs or exclude any days you don’t want to monitor.

To learn more:

Actions Tab

Finally, for the last tab, ‘Actions’, we have selected to use a NOTIFY action to notify the security admin.

We also selected a WARN action to show a warning to the offending user. For this action, we decided to use the HTML template option to make the alert prominent to the user.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2019-08-05 at 16:03:31, employee Martin Sutherland signed in. Since the action meets the rule criteria (Login: between 12am – 8am and 6pm – 12am), it is triggered.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

When a user logs in outside our set schedule, they will see a warning message. Note that, the login time is based on the user’s local time.

This example shows how you can create a simple Activity rule to warn a user when they send an email with attachment(s) to a non-business email address.

General Tab

On the first tab, General, we assigned a name for the rule and a description. We also used some tags to identify the rule easily.

We have chosen an Activity rule type since we are looking to detect a user action (the act of sending an email) and not any content. We have selected Emails as the Types of Activities.

We left the rule schedule to its default 24-hour setting.

To learn more:

User Tab

For the users, we used the default policy settings (by leaving the INHERIT POLICY SETTINGS option turned on).

To learn more:

Emails Tab

Mail To

We have added three criteria to the Emails activity. For the first criterion, ‘Mail to’, we have specified several email domains that we would consider as ‘non-business’ addresses and used a contains logic to detect even a partial match.

Mail Direction

For the second criterion, ‘Mail Direction’, we have selected OUTGOING to detect only the outgoing emails.

Has Attachments

For the second criterion, ‘Mail Direction’, we have selected OUTGOING to detect only the outgoing emails.

To learn more:

Actions Tab

Finally, for the last tab, ‘Actions’, we have selected to use a WARN action to just show a simple warning to the user.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2019-07-28 at 06:02:33, employee John Doe sent an outgoing email to a non-business email account and the rule gets triggered.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

You can see that, as soon as the user sends an email to a non-business address, the rule’s warning message is shown on the top-right corner of their screen.You will notice that, the message is very bare-bone and may fail to attract any attention. You can change that by customizing the rule messages and alert.

This example shows how you can create an Activity rule to block a user and display a message for attempting to upload certain files to a cloud drive.

General Tab

On the first tab, General, we assigned a name for the rule and a description.

We have chosen an Activity rule type since we are looking to detect a user action (the act of uploading a file) and not any content. And we have selected Files as the Types of Activities.

We left the rule schedule to its default 24-hour setting.

To learn more:

User Tab

For the users, we choose to manually add the users (by turning off the INHERIT POLICY SETTINGS). We have also excluded the Management department from the rule’s scope.

To learn more:

Files Tab

File Operation

We have added two criteria to the Files activity. For the first criterion, ‘File Operation’, we have selected the Upload operation.

Upload File Name

For the second criterion, ‘Upload File Name’, we have specified some keywords that we would like to detect in the file names.

To learn more:

Actions Tab

Finally, for the last tab, ‘Actions’, we have selected a BLOCK action to block the activity and at the same time show a message to the user. For this demonstration, we used a HTML template. This will allow us to use a customized template. We can also use simple HTML tags (such as <b>, <a> etc.) in the message itself.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2019-07-08 at 08:58:54, employee Kate Sparrow tried to upload a file to Google Drive and the rule blocked her action.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

You can see that, as soon as the user attempts to uploads a file named ‘sensitive.txt’ the rule is triggered as the filename contains one of our specified keywords, ‘sensitive’.The rule shows the message we specified, and the upload operation is blocked.

Also, unlike the previous example, this time we used a customized HTML template and you can see the result. The warning message is now shown in a nice alert box.

This example shows how you can create a Content rule to block a user and display a message for attempting to upload a file containing credit card numbers. The user will be given a choice to continue or cancel the file operation. In any case, a rule alert will be recorded.

General Tab

On the first tab, General, we assigned a name for the rule and a description.

We have chosen a Content Sharing rule type since we are interested in detecting sensitive content. We have selected Files as the Types of Content.

We changed the rule schedule so that it will monitor 9am-12pm and 12:30pm-5:00pm, a typical work time taking into account a 30-minute lunch break.

To learn more:

User Tab

For the users, we used the default policy settings (by leaving the INHERIT POLICY SETTINGS option turned on).

To learn more:

Content Tab

For content, we used a built-in template, ‘Predefined Classified Data’ and then sleeted the ‘Financial Data’ category to detect ‘All credit card numbers’. The rule will trigger even if there’s only one credit card number detected in a file. We did so by entering a value of ‘1’ in the TRIGGER ON PATTERN FREQUENCY IN CONTENT field.

Actions Tab

Finally, for the last tab, ‘Actions’, we have selected a BLOCK action but turned on the ALLOW BYPASS WITH CONFIRMATION? option. This will show a warning to the user and block the action. But it will also show two YES and NO buttons. If the user clicks YES, they will be able to override the block.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2019-08-05 at 12:17:45, employee Simon Woodly tried to upload a file containing credit card data to a Box drive and the rule got triggered.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

On this screen, you can see that the user creating a text file containing some credit card numbers and saving it on their desktop.

The user then attempts to copy the file to a network folder. You can see that, as soon as the user attempts to copy the file, the rule is triggered giving the user the option to continue or not. If the user clicks YES, the file copy operation will continue as usual. If they click NO, the copy operation will be cancelled.

Also, in this example, we used yet another customized HTML template to show the warning message.

This example shows how you can create an Anomaly rule to monitor the productivity level of employees and receive a notification when it goes below a certain threshold. You will also be able to compare this against their Departmental and Organizational average.

General Settings Section

On the first section, General Settings, we assigned a name for the rule and a description.

For the users, we have selected All employees.

We have also used a tag to find the rule easily.

To learn more:

Rule Trigger Section

We chose the Activity: Productivity as the rule trigger.

For the rule’s condition, we selected the Productivity criterion and chose a less than ‘<’ logic to detect when the productivity goes below 20%.

To learn more:

Rule Risk Level Section

We left the risk level’s default settings (No Risk) and ACCUMULATES RISK option turned on so that multiple violations of the rule will add up towards the risk score for this rule.

To learn more:

Rule Actions Section

Finally, for the last section, ‘Actions’, we have turned on the NOTIFY action to inform a manager about the productivity loss.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2021-04-11 at 04:44:45, employee Leo Gross triggered an anomaly rule due to his productivity dropping to 11% where his usual productivity was above 52% before.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

You can click the Notification (Bell) icon near the top-right corner of the Session Player to see all the alerts/notifications.

Click a Notification to see what the user was during when the rule was triggered.

This example shows how you can create a simple Windows Log Event-based Activity rule to warn a user when they are installing or uninstalling any application.

General Tab

On the first tab, General, we assigned a name for the rule.

We have chosen an Activity rule type since we are looking to detect a user action (the act of installing/uninstalling a file) and not any content. And we have selected Window Log Event as the Types of Activities.

We left the rule schedule to its default 24-hour setting.

To learn more:

User Tab

We turned off the INHERIT POLICY SETTINGS on the User tab so that we can manually select Everyone.

To learn more:

Windows Log Event Tab

Event ID

For the Event ID criteria, we have entered 1040 with the equal '=' condition. Windows uses this Event ID to log anytime the MSI Installer is run. This installer is used to install application packages (usually with a .msi extension). By looking for this event, we can detect whenever a user tries to install an application. Note that there other other methods/events to detect installation of applications, but this is one of the most common events you can check.

To learn more:

Actions Tab

Finally, for the last tab, ‘Actions’, we have selected a WARN action to let the user know that their activity is being tracked. For this demonstration, we used the HTML template option so that the message is displayed in a nice pop-up window.

To learn more:

Click BI Reports > Behavior Alerts then select the Basic tab to view a report of all rule violation alerts and trends. The ‘Grid Widget’ located below the screen shows a list of all the alerts:

You can see that, on 2023-11-19 at 09:07:26, the rule was triggered for employee John Simmons.

Right-click on that row and then select View record to view the Session Recording of the alert.

Here you can see the Session Recording of how the rule message will look on the user’s desktop:

You can see that, the user is installing the "ScreenToGif" software. As soon as the Windows installer launches, the rule's warning message pops up.

For additional details, you can check the Windows Event Viewer on the user's computer and search for Event ID 1040:

You can access the prebuilt templates from the CHOOSE A TEMPLATE pull-down menu on the Rule Editor's General tab: