“Omni” stands for ‘all’ or ‘universal’. It’s our very first AI/ML module that’s currently in public beta.

Omni provides a snapshot view of the most critical insights and incidents about your organization in a social media-like (think Facebook newsfeed) interface with scrolling video feeds.

It’s an oversight tool that will help business owners and managers keep an eye on the organization’s productivity and security without digging through detailed reports. It’s also a powerful investigation tool that can be leveraged by your analysts for identifying threats, detect anomalies, flag frauds, etc. and conduct forensic investigations, and case management for data leak incidents.

On the top-left corner of Omni’s main screen, you will see a donut graph that shows the total number of insights for the selected period along with a breakdown of risk levels. Currently, the risks are derived from the behavior rules’ risk fields but in the future, it will include other indices.

The Interaction History on the left panel shows a list of insights/alerts you have decided to Mute or Dismiss (see below). This way you can unmute or enable the insight/alert again if wanted. Note that the unmute/reenable feature isn’t implemented yet.

The main feed area shows a scrollable list of insights and alerts for all users by default (you can apply filters to change the feed, see below).

On the top-left corner of a feed, you will see details of the particular feed including the Insight Type, duration, and the trigger that caused the incident.

If a feed shows the Stack icon, it means, it’s an aggregated feed (a combination of similar feeds within a given time frame). The video for an aggregated feed is usually longer than individual insight/alert feeds.

The video player works like the Session Player with similar play/pause and other playback controls.

Click the Filter button to bring up the Filter panel on the right. These are filters you can apply to the feed:

You can select All, a single employee, or multiple employees to filter the feed.

OMNI draws its information from two sources:

You can apply one or more source filters to the feed.

If the Source is “Insights”, it will show you individual insights, for example, “Activity Falsification”. If you choose “Behavior Rule Alerts” as the Source, then it will show all the behavior policies you created under the Behavior > Policies screen.

You can apply one or more category filters to the feed.

Shows individual insights under a category. For example, if your Source=”Insights”, Category=”Activity Falsification”, you will see two types, “Key pressing” and “Inorganic mouse movement”.

You can apply one or more type filters to the feed.

The Dismiss button works like an ignore button and applies to a single insight/alert. It’s a quick way to ignore false positives:

When you dismiss a feed, you will see a pop-up feedback window:

This feedback will help Teramind understand what type of insights/alerts are effective or not, if it’s a false positive, etc., and tune the AI/ML engine for better detection in the future.

The Mute button will hide an entire Insight Type:

You can mute the insight/alert type for yourself, for the agent/employee that triggered the insights/alerts or mute it for the entire organization.

When you mute a feed, you will see a pop-up feedback window:

This feedback will help Teramind understand what type of insights/alerts are effective or not, if it’s a false positive, etc., and tune the AI/ML engine for better detection in the future.

When you click the Investigate button, it will take you to a new screen. Depending on the Insight Type, you might see slightly different screens:

The Details view shows details about the incident while the History view shows comments and actions (e.g., mute/dismiss) you and others have taken on the incident:

These buttons work similarly to the Dismiss/Mute buttons on the main Omni screen.

This button works similarly to the Comments buttons on the main screen.

The Session (Video) Player works similar to the Session (Video) Player on the main screen.

Insight Details shows details about the incident while General Activity shows all the user activities (e.g., App activity, Web activity, Keystrokes, Alerts, etc.) leading up to the incident:

Like the BI Report’s Grid widget, you can configure the columns to be displayed.

The Comment button will show a red dot if there are existing comments attached to the feed:

If you click the button, a pop-up window will open where you will see comments by you and others:

The Sort by feature allows you to sort the feeds in different ways: