Introduction to the Session Player

The Session Player is a pop-up player/window which allows you to playback the screen recordings/audio recordings of a user's computer and interact with it (if the user is online). 

You can also do the following on the Session Player:

• Remote control a user's computer (RDP)
• Freeze the user inputs (lock out keyboard/mouse input)
• Activate the Windows Task Manager (send the CTRL+ALT+DEL command)
• Track Notifications (Behavior Alerts) and Activities
• Quickly search for any activity and notification
• Add Tags and notes for auditing purposes
• Take a Screenshot
• Export the video

Accessing the Session Player

The Session Player can be accessed from many places, such as the Dashboards, BI Reports, Monitoring Reports, etc. You can launch the Session Player by clicking the Movie Camera icon, anywhere you see it.

Playback Mode

The Session Player supports both Live View and History Playback features.

Live Mode

With the Live Mode, the Session Player turns into a fully functional remote desktop client. You can view a real-time stream of the user’s desktop, take remote control of it, freeze input or lock out the user.

Note that, the Live Mode is available only when a user is online. You will see the ‘Live’ indicator on top of the player turns Orange when the session player is in Live Mode.

History Playback Mode

With the History Playback Mode, you can use the Session Player to view previous desktop session recordings of the user.

Both modes allow you to see detailed list of Notifications and Activities related to the user. If Audio recording is enabled, you can also hear recordings of both sound outputs and inputs (speakers/line-out, microphone/line-in). Finally, you can forward the recordings to select email addresses or download them as MP4 files.

Basic Navigation

1. Use the Play/Pause buttons to play/pause the video.
2. Use the Rewind, Fast Forward, Beginning/End buttons to control the playback. Note that, these controls aren’t available on the Live View mode.
3. Use the Speaker button to turn sound on/off.
4. You can also drag the Play Head to move back and forth on the recording timeline.
5. When Notifications is turned on (see the Viewing Notifications and Activities section), you can click a Notification Indicator to jump to a time where a rule violation incident occurred.
6. If the Timeline is grey, it means video recording is available for that time. If it’s black, it means video recording is missing. There might be several reasons for missing recordings for a period of time. For example, the user was logged out, the agent was disabled, screen recording turned off, locked session recording is turned off, etc. Check out this Knowledge Base article to learn about troubleshooting video recording issues.
7. You can see the Time and Date of the recording. Click on either the Time or Date to enter a new time/date.

Live Mode Controls

There are three special buttons available on the Live Mode, using which you can control the user’s desktop.

1. Invoking the Task Manager (Windows): Use the Warning button to send CTRL+ALT+DEL command to the user’s computer. This will bring up the Windows Task Manager screen, where you can access options to change the account password, switch a user etc.
2. Freezing User Input: Use the Padlock button to freeze/unfreeze user’s input. When input is frozen the user won’t be able to use their keyboard or mouse.
3. Remote Control: Use the Remote-Control button to take full control of the user computer.

Taking Screenshots

1. Use the Camera  button to take a screenshot of the desktop and save it as a PNG file.

Downloading / Exporting Videos

1. Click the Cloud Download button. A pop-up window will open.

2. On the Video params pop-up window, select a date and specify time range, video speed and an email address. You can also disable audio if wanted. Click the Start export button.

3. Once the video is ready, an email will be sent to the specified email address(es) with a link to the video for download.

Viewing Notifications and Activities

1. Click the Notification button.
2. You will see a list where you can switch between Notifications and Activities.  You can also search for an activity using the search button.
3. Click on any notification/activity to move the Player Head to the time when the notification/activity occurred.

Viewing / Adding / Removing Tags

You can add custom tags to the video for auditing, tracking or other purposes. Tags let you mark a time on the video and add a label to it. You can also add notes.

1. Click on the Notifications icon
2. Select the Tags tab. You will see a list of existing tags (if any).
3. Click the Add new tag link to create a tag. This will open a pop-up window where you can specify the tag details such as tag name, date, time and notes.
4. Click on a Tag to move the player head to the time the tag was created.
5. Click the X button to delete a tag.

Risk

Introduction to the Risk Report

The Risk report allows you to conduct organization-wide risk assessment. The report shows top risky users, rules and objects (applications and websites). The report also lets you plot risk trend by department, severity, number of violations, tags (tags are used to identify a rule) etc. Unique risk score helps you identify high-risk users or policies so that plans can be developed for treating the risks. You can filter the report by employee, department, severity and tag.

Accessing the Risk Menu

1. You can access the Risk report by clicking the RISK menu.

Plotting the Risk Trend

You can control what the top two graphs on the Risk report will show through their three pull-down menus:

1. The first menu lets you choose the frequency of the data being plotted. You can choose from Daily, Weekly or Monthly options.
2. The second menu lets you choose the X-axis (horizontal) categories for the graphs. You can choose from Tags, Departments and Severity.
3. The third menu lets you choose the Y-axis (vertical) values for the graphs. You can choose between Violations or Risk Scores.

Identifying High Risk Users, Rules and Objects

The bottom part of the Risk report has three panels that show the top risky users, rules and objects.

1. At the top-right corner of the users and rules panels, you can see how many users/rules are identified as the top risk, how many of them are new, and how many risk items were dropped (based on the time period you have selected for the report).
2. The third column of the risk items shows the up, down arrows or no change (no indicator arrow) trend for each risk.
3. You can click on any risk item to expand it.  When expanded, it shows the top risky items causing the risk. For example, if you click a Rule item, it will show the three top users who are associated with the risk and a break down of their risk contribution (in percentage).

Productivity [deprecated]

Introduction to the Productivity Reports

The Productivity report lets you track employee productivity and performance. It shows productive, unproductive, active and idle time and how much you are spending on employee wages/salary.

Productivity report aggregates data from the activity monitoring, employee profiles, app/websites classification and other configurations such as departments, schedules, user input from the Revealed Agent etc.

Accessing the Productivity Report

1. Hover over the PRODUCTIVITY menu, then
2. Click the Overview or the Time Worked sub-menu.

Productivity Report Explained

Color guide:

The color table below shows the activity %:

	Green = 70% – 100% activity
	Yellow = 11% – 69% activity
	Red = 0% – 10% activity

 

Summary vs. Detailed View

When viewing the report for multiple days, you can expand a row to view details for each day in addition to a summary of all days.

1. Click the up/down arrow button at the right side of a user’s row to expand/collapse it.
2. When expanded (Detailed View), each date is shown in separate rows in addition to a summary for all days.
3. When collapsed (Summary View), the dates are aggregated into a single row for each employee.

Behavior > Policies & Rules

Introduction to the Behavior Policies & Rules

The Behavior menu consists of the Polices, Alerts and Anomaly Rules. These features utilize Teramind’s core Behavioral Engine. With the Rules Editor,  you can set up conditions to detect any unproductive, harmful or dangerous activity in real-time, while having Teramind act on your behalf. When a rule is violated, you can be notified about incident and optionally, the system can take actions automatically in different ways (such as warning the user, blocking the activity etc.). You can see the rule violations report from the Alerts screen. Teramind also lets you create Anomaly Rules. These special types of rules use behavioral baselines to detect and prevent behavioral anomalies that’s harder to implement with the regular policies and rules.

Policies

Policy helps you organize similar rules together. In a sense, policies are like folders where you keep your rules. For example, you can have all your PCI related rules under a policy called ‘PCI compliance’. Or, keep all your HR specific rules such as ‘Preventing email harassment’, ‘Limiting social media use’ etc. under the ‘Business Etiquette’ policy.

Each Teramind solution comes with a sample policy containing several sample rules. You can experiment with the sample rules to learn how the rules work. Once you are comfortable, you can create your own rules with the intuitive yet easy to use Rules Editor.

Accessing the Policies Menu

1. Hover your mouse over the BEHAVIOR menu, then
2. Select Policies from the sub-menu.

Creating a New Policy

1. Click the  CREATE NEW POLICY button. A pop-up window will appear.

2. On the Create a New Policy window, enter a name for the policy. Select the users the policy will apply to and optionally, select any users you want to exclude from the policy. Click the CREATE button to create the policy.

Importing a Policy

To import a previously exported policy, click the IMPORT POLICY button located near the top-right side of the screen. You will be asked to upload the policy file (Teramind policy files are usually saved with a .TM extension).

Moving / Exporting / Editing / Deleting Policies

1. Click the Dotted menu at the top-right corner of the policy. A pop-up menu will open.
2. To move a policy up on the list, click the Move Policy up button.
3. To move a policy down on the list, click the Move Policy down button.
4. To export a policy, click the Export Policy button. The policy will be saved with a .TM extension.
5. To edit a policy, click the Edit Policy button. An Edit Policy window will pop-up where you can edit the policy.
6. To  delete/remove a policy, click the Delete Policy button.

Creating / Editing Rules

1. Click the the BEHAVIOR > Policies menu. Click the  ADD RULE FOR THIS POLICY button near the bottom of the policy to add a rule to the policy.
2. Click a rule’s name to edit it.

In both cases, you will be taken to the Rules Editor where you can edit the rule. Check out the Rules Editor for more information on how to create or edit rules.

Moving / Exporting / Editing / Deleting Rules

1. Click the Dotted menu at the top-right corner of the rule. A pop-up menu will open.
2. To export a policy, click the Export rule button. The rule will be saved as a .TM file.
3. To edit a rule, click the Edit rule button. Note that, you can also click the rule’s name to edit it. In both cases, you will be taken to the Rules Editor where you can edit the rule. Check out the Rules Editor for more information on how to create or edit rules.
4. To duplicate a rule or to move it to another policy, click the Copy or Move Rule button. A pop-up window will open where you can choose to copy or move the rule.
5. To  delete/remove a policy, click the Delete Policy button.

Rules Editor

The Rules Editor is an intuitive, visual editor where you can create sophisticated behavioral rules easily without going through multiple screens or coding. Here are the main parts of the editor:

1. The left-most part of the editor is where the main tabs/steps of a rule are displayed. A basic rule has at least three tabs: General, User, Category and Action. Note that, the exact name for the Category will change based on which rule category you select on the General tab. For example, on the screenshot above, the Category is ‘Emails’.
2. The middle part of the editor is where you specify the actual rule parameters.
3. The right-most part of the editor displays a summary of the rule in easy to follow language.

General Tab – Setting the Rule Basics

In the first tab, General, you specify the basic settings for the rule. You also select which activity or content the rule will detect.

Rule Name and Description

1. On the top fields, you can specify a name and optionally, a description for the rule.

Rule Template

1. When creating a new rule, you can choose from a list of pre-built templates. Click the CHOOSE A TEMPLATE field to choose a template on the General tab. Teramind has many templates for Data Loss Prevention, Email, Applications, Websites, File Operations etc. Once you select a template, the rest of the rule’s tabs will be automatically populated with pre-configured settings and sample data. You can, of course, change the settings.

Rule Category and Type

1. There are three categories of rules you can select from the SELECT THE TYPE OF RULE drop-down menu on the General tab:
   • Agent schedule: This is the most basic rule type. It’s based on an agent/user’s schedule such as when an employee started work, if they are late at work, if a user is idle etc. The rule takes input from the Schedules you create for employees to determine when a user/agent is supposed to start/finish.
   • Activity: Activity-based rules apply to majority of the monitored objects. With this type of rules, you can detect user and application activities. For example, warn a user when they visit a gambling site, Or, stop them from copying a sensitive file to an external drive.
   • Content sharing: These rules are used to detect content or text inside an object. The object can be a file, a web page, text in an email or IM chat etc. These powerful rules can be used to prevent data exfiltration attempts such as, block transferring of a file when it contains credit card numbers; warn a user when they attempt to send emails containing sensitive keywords etc.

2. Optionally, you can assign tags to a rule to easily identify it or use them as filters (i.e. on the Risk or Alerts report).
3.  Once you select a rule type, you can then select the Types of Activity (for Activity-based rules) or Types of Content (for Content-based rules). You can select multiple activity or contents. If you select multiple activities/contents, the rule will trigger separately for each of the activity/content. Note that, rules based on the Agent schedules do not have this section.

Rule Schedule

1. By default, the rule stays active for 24 hours. However, you can change the time. For example, you can have the rule active during work hours but disable it during the employee lunch breaks. To change when the rule is active, drag the two small Circles to adjust the time. You can click the Plus (+) and Minus (–) buttons to add/remove additional time slots.

User Tab – Specifying Users and Groups

Here you specify which users, groups or departments the rule will apply to.

1. By default, the rule will inherit the user settings from the policy. However, you can turn it off to select users manually.
2. You can specify who the rule will apply to and optionally, exclude anyone you don’t want to be included using the EXCLUDE FROM RULE field.

Categories Tab – Setting Rules Conditions

Categories is where you define the conditions for the rules.

1. The Categories tab will change depending on what Types of activities / Types of content you choose from the General tab. So, for example, if you choose Applications and Files, you will have two tabs named Applications and Files here.
2. Condition Parameters – Option 1: For categories that support it, click the Plus (+) button to add parameters to a condition. A small pop-up menu will appear where you can select a parameter. You can select multiple parameters for a condition. In such cases, the conditions will show up as separate tabs. Condition parameters are different for each category. For example, the Application category might have parameter such as ‘Application Name’, ‘Application Caption’ etc. while the Emails category might have ‘Mail Body’, ‘Mail Subject’ etc. You can delete a condition parameter by clicking the small X button next to its name.

3. Condition Parameters – Option 2: For categories (i.e. Files) that do not have a  Plus (+) button, the CONDITION field is used to set its rule parameters.

4. Conditions Values: For categories that support it, you use the CONDITION field to specify what values to compare the rule parameters with. Start typing, then select an option from the pop-up to tell Teramind what type of value it is. There are may ways you can use the conditions. For example, to block certain applications from running, you can type them in the CONDITION field and choose the Contains or Equals from the list. Or, you can create a Shared List containing all the names (see Shared Lists section for more information on how to create shared lists). For complex matches, such as Credit Card Numbers, Social Security Numbers etc., you can use the RegEx option. Each value is considered as an ‘OR’ clause. So, in the above example, the rule will trigger if the ‘Application Name’ matches with ‘regedit’ or ‘pseditor.exe’. Each condition parameter is considered as an ‘AND’ clause. So, in the above example, the rule will trigger if the ‘Application Name’ and the ‘Launch from CLI’ parameters meets the condition.
5. Addition Conditional Blocks: To add additional condition blocks, click the ADD CONDITION button. Each new condition is considered as an ‘OR’ clause. So, if either of the conditions meets the criteria, the rule will be triggered.
6. Deleting Conditional Blocks: To remove a condition block, click the small  X  button at the top-right corner of the condition block.

Content Tab – Defining Sensitive Data Types

This tab allows you to define what makes the content sensitive and specify values to look for. Note that, Content tab is available only on Teramind DLP and is shown only when you select the Content sharing rule type.

1. You can specify several content types depending on what Types of activities / Types of content you have selected in the General tab (i.e. Clipboard, Files, Emails, IM).

Data Content

1. Data content can be used to look for text or binary data for any of the content types. You usually use the Data content rule where you are looking for information in all the supported objects. For example, by using it with the Clipboard, you can detect anything copied on the clipboard.
2. You can use Contains, Equals, Regular Expression match, List match etc. from the SELECT MATCH TYPE pull-down menu.

Clipboard Origin

1. Clipboard Origin detects data that’s pasted into the clipboard from a specific webpage or application. By using it you can, for example, build a rule that prevents copy pasting customer data from your CRM site.
2. You can use Contains, Equals, Regular Expression match, List match etc. from the SELECT MATCH TYPE pull-down menu.

File Origin

1. File Origin detects file sharing based on their origin or source. It supports local, Cloud and web file sharing. By using it you can, for example, build a rule that prevents sharing of files residing in certain PATH (or folder) to Cloud drives.
2. You can select from a list of Cloud providers if you choose the CLOUD option.
3. You can use Contains, Equals, Regular Expression match, List match etc. for the FILE PATH field.

File Properties

1. File Properties detect files based on their meta-tags. By using it you can, for example, build a rule that prevents sharing of any Microsoft Word documents outside your company that has a Tags property containing the string value of ‘internal only’. You can create such tags/fields/properties from an application (such as Microsoft Word) or from the Windows Explorer.
2. You can use Contains, Equals, Regular Expression match, List match etc. from the SELECT MATCH TYPE pull-down menu.

Classified Data

1. Classified Data detects content based on predefined data categories, such as, credit cards, Personally Identifiable Information (PII), Protected Health Information (PHI) etc. By using it you can, for example, build a rule that warns a user when they share credit card numbers over the emails or IM chats.
2. There are several types of data categories you can choose from: Financial Data, Health Data, Personally Identifiable Data and Code Snippets.
3. The SENSITIVE DATA TO DETECT will have different menu options depending on what you choose in the SELECT SENSITIVE DATA CATEGORY field. For example, if you choose Financial Data in the previous field, you can choose from ‘All credit card numbers’, ‘Magnetic data’, ‘SWIFT code’ etc. Similarly, if you choose the Health Data, you can choose from ‘Common drug names’, ‘Common disease names’, ’DNA profile’ etc.
4. Finally, you can specify how often a data pattern can appear in the content before the rule is triggered. As an example, you might not care if a single credit card number is detected in an email, but if more than 5 such numbers are detected then you would like to warn the user.

Actions Tab – Responding to Rule Violation Incidents

Actions tab is where you specify what the system will do when a rule is violated. You can warn a user or block them, receive notification, record a video of the desktop etc. Note that, not all rule categories support all actions. For example, most of the Agent Schedule-based rules only support the NOTIFY action (except for the Login and Idle schedules). Same way, different Activity Type or Content Type may also have their own special actions. For example, Webpages have an action called REDIRECT which is not available for other activity types. Also, not all actions are available on all the operation systems. For example, the LOCK OUT USER action does not work on the macOS at the moment.

In some cases, you can use multiple actions as long as they do not conflict with each other. For example, you can use the NOTIFY and BLOCK actions together as they do different things. But you cannot use the BLOCK and LOCK OUT USER actions together because they both prevent the user from doing something. The Rule Editor will automatically grey-out/disable actions that conflict with the currently selected action(s).

There are two ways you can setup actions: Simple Mode and Advanced Mode.

Simple Mode

Simple Mode is the easiest way to create rules and is recommended for beginners. In the Simple Mode, you can specify actions, but you cannot set any risk thresholds.

 Here are some of the actions you can use:

	Notify Teramind will send an email n>otification to the specified admins/managers whenever any user violates the rule.
	Block Blocks the user activity and shows a message. You can use a HTML template to display the message (see the Behavior > Alerts article for more information on using an HTML template with your rule messages).
	Lock Out User Shows a warning message to the user and then when they press the OK button, they are locked out of the system. If the user logs back in, they will be logged out automatically. An administrator has to unlock the user for them to be able login again (See the Employee Action Menu section for more information on unlocking a user). i This action works on Windows only.
	Redirect Redirects user to a different website when they try to access certain URL(s). i This action applies to Website-based rules only.
	Warn Warns a user with a message. Similar to the Block rule, but without blocking the action. You can use a HTML template to display the warning message.
	Set User’s Active Task You can automatically assign the user a task based on their activities. i Applicable only if the user is using a Stealth Agent.
	Record Video If video recording is disabled in your Screen Monitoring Settings, you can still record a video of the rule violation incident with this action. The system will automatically record for the specified number of minutes before and after the incident.
	Record Video With this action, you can execute a Windows command automatically when a rule is violated. i This action works on Windows only.

Advanced Mode

In the Advanced Mode, you can specify risk thresholds for a rule. You can add multiple thresholds, assign risk levels and take different actions depending on how often the rule is violated. For example, you can set an email rule that sets a Low risk and a Warn action when a user sends 5 emails in a day.  However, if they send more than 10 emails a day, then set a Moderate risk level and trigger a Notification action.

The risk levels that you assign in the Advanced Mode are used by Teramind to calculate risk scores (see the Risks section to learn more about risk analysis) and can also be used to filter other reports (i.e. Alerts).

1. You can choose the time period for the thresholds such as Hourly, Daily, Monthly etc.
2. The threshold slider lets you adjust the frequency once you have added one or more thresholds.
3. Click the ADD THRESHOLD button to add new threshold (actions). For example, in the picture above, we added two actions (action 1 and action 2).
4. You can use the Frequency field to set a frequency.
5. Use the Define a risk level field to set a risk level. You can choose from: No Risk, Low, Moderate, High and Critical.
6. Use the small Plus (+) button to add an action for the frequency/risk level.
7. You can set additional risk levels and associated action as you need.

Behavior > Alerts [deprecated]

Introduction to the Alerts

The Alerts report shows all the rule violation incidents (triggered by the regular Rules) and any anomalies (triggered by the Anomaly Rules). The report shows the date/time the incident happened, which user was involved, what policy and rule were violated, what action was taken by the system and a description of the incident (i.e. what applications the employee was using and what triggered the alert).

The report also shows a trend graph for the number of alerts triggered over the period. Like all other reports, you can view a session recording of an alert incident by clicking the movie camera icon on the Employee column. Same way, you can also export an alert report or schedule it for auto delivery to selected email addresses. Check out the Performing Common Reporting Tasks section to learn how to perform these common report actions.

Accessing the Alerts Menu

1. Hover your mouse over the BEHAVIOR menu, then
2. Select Alerts from the sub-menu.

Applying the Alert Filters

1. There are multiple ways to filter the Alerts report. You can do so by using the drop-down menus located at the top-left corner of the report. You can filter by Policy, Severity, Tags or Actions. This is helpful if you have many alerts and wanted to narrow down the list.

Showing / Hiding Alert Triggers

1. You can use the SHOW TRIGGERS button to toggle the display of additional information about a rule violation incident. When triggers are turned on, the Display column will show additional information such as what part of the rule condition was trigger and for which activity or content.

Behavior > Anomaly Rules

Introduction to the Anomaly Rules

Anomaly rules are special types of rules that allow you to identify anomalies in a user’s behavior by utilizing behavioral baselines. It also allows you to assign risk levels to any anomalous behavior and a notification action to inform admins or managers about the anomaly.

Accessing the Anomaly Rules Menu

1. Hover your mouse over the BEHAVIOR menu, then
2. Select Anomaly rules from the sub-menu.

Filtering / Editing / Deleting / Copying Anomaly Rules

1. If you have many anomaly rules, you can decide what’s displayed by using the filters on the left side of the Anomaly Rules screen. You can clear the filters by clicking the small Funnel icon.
2. To edit an anomaly rule, click the Pencil icon. You will be taken to a rule editor. Follow the Anomaly Rules Editor section to learn how to edit an anomaly rule.
3. Click the Copy icon to duplicate a rule.
4. Click the X icon to delete a rule.

Creating Anomaly Rules

1. Click the ADD ANOMALY RULE button at the top-right corner of the screen. A pop-up window will open.

2. Click the CREATE NEW RULE button if you want to create a rule from the scratch. You will be taken to the Anomaly Rules Editor. Follow the Anomaly Rules Editor section to learn how to edit an anomaly rule.
3. Click the USE TEMPLATE button to create a rule based on a template. Teramind comes with many anomaly rules templates. You can choose from a list of types such as: Applications, Emails, File Operations etc. Click on a type to expand it. Pick a rule template and click the LOAD TEMPLATE TO USE button. You will be taken to the rule editor. Follow the Anomaly Rules Editor section to learn how to edit an anomaly rule.

Anomaly Rules Editor

The Anomaly Rules Editor is an intuitive, visual editor. The single-page interface of the editor makes it easier to view and edit the rules.

General Settings

You can specify basic rule settings on the General Settings section of the Anomaly Rules Editor.

1. Give the rule a name on the RULE NAME field.
2. Select the users the rule will apply to on the APPLIES TO field.
3. Select any users that should be excluded on the EXCLUDING field.
4. Optionally, you can assign tags to a rule on the TAGS field to easily identify it.

Rule Trigger

The Rule Trigger section lets you specify which activity the rule engine will monitor and what conditions it will evaluate.

1. Select a trigger from the list. You can choose from many pre-built options such as Webpages, Applications, Emails, Productivity, Network etc.
2. Under CONDITIONS, you can choose different types of conditions such as:
3. Time (%): with this you can create a rule for time spent on certain task. For example, you can create a rule that gets triggered if a user spends more than 10% time on a certain website.
4. Anomaly baseline: uses algorithm to determine if certain user behavior is outside their normal behavior. This can be the user’s current behavior compared to their past behavior; an employee’s behavior compared to their departmental baseline; or an employee’s behavior compared to baseline of the entire organization. Using a baseline lets you, for example, set an anomaly rule to notify you when a user sends an unusual number of emails than they normally do in a day-to-day basis.
5. Other Conditions: depending on what trigger you selected, you may see additional conditions. For example, if you choose the Webpages trigger, you will see the Url condition listed as an option on the menu.
6. Click the ADD CONDITION button to add a new condition row.
7. Click the X button next to a condition to delete it.

Rule Risk Level

Rule Risk Level section lets you assign a risk level to the rule. The risk level is used by Teramind to calculate risk scores (see the Risk section to learn more about risks) and can also be used to filter reports (i.e. Alerts).

1. Click and drag the Circle  to adjust the risk level.
2. You can turn risk accumulation on/off. If turned on, the risk associated with this rule will be counted multiple times for multiple violations. Otherwise it will be counted once for all violations.

Rule Actions

Anomaly rules only support the NOTIFY action.

1. Turn the notification on/off by using the NOTIFY button.
2. Select the users who will get notified when the rule is violated.

Saving the Rule / Creating a Rule Template

1. Click the SAVE AND LAUNCH RULE to save and activate it.
2. Click the SAVE RULE AS TEMPLATE button to save it as a template. This way, the template will be available when you are creating a new anomaly rule (see the Creating Anomaly Rules section to learn how to use an anomaly rule template).

Employees

Introduction to the Employees

The Employees screen is where all your employees and other users are listed. You can see when a user logged in, which computer they logged in from, their status (i.e. active, idle, locked etc.) and if they are currently being monitored.

From the Employees screen, you can also perform actions such as add/import/delete/restore employees, lock/unlock their computers etc.

Accessing the Employees Menu

1. Click the EMPLOYEES menu to access its screen.

Adding a New Employee

1. Click the NEW EMPLOYEE button near the top of the screen. A pop-up window will open where you can edit the employee’s profile details such as their personal information, account security, monitoring options etc. See the following section to learn how to enter these details for a new employee.

Entering / Editing Employee Profiles

When either creating a new employee or editing an existing employee, a pop-up window will open where you can enter/edit the employee details such as their personal information, account information, authentication and monitoring options:

Here are some of the actions you can use:

	Personal Info On the first tab of the employee details window, you can enter the user’s personal details such as names, contact info, department, position etc. You can also upload a photo for the employee. If you enter any wage/salary information, you will be able to see the user’s contribution on the Productivity widgets and the Productivity report. i Please do not change the email address of the employee if they are using the Hidden Agent. As the email address is used to identify the employee in the system.
	Account Information On this tab, you can specify the user’s default task (if the employee is using a Hidden Agent). You can also set their access level. There are four types of access levels you can choose from: Employee – cannot change any settings. Infrastructure Admin – has access to the system settings but cannot browse any recordings. Operational Admin – has access to the system settings, rules, computers, other users and access control settings of other users. Administrator – is the most powerful access level. They can monitor all employees, other admins and change any settings with no restrictions. On this tab, you can also specify other account security settings, such as: if the employee can view their own dashboard, what reports they can access, if they are an external user etc. Finally, you can change the password for the employee here.
	Authentication Here you can enable/disable 2-Factor Authentication for the user. Scan the barcode in your 2FA application (such as Authy or Google Authenticator) then apply the code from the application in the Code from Authenticator app field.
	Monitoring Option On this tab, you can specify which monitoring profile to use for this employee and also manually control what they will be tracked for. Check out the Monitoring Settings section to learn more about monitoring profiles.
	Productivity Profile On this last tab, you can see which productivity profile is used for this employee. However, you cannot edit it from here. To learn how to edit a productivity profile, check out the Productivity Profiles section of the User Guide.

Adding Employee and Sending Invitation

After entering/editing the user details, do the following:

If you are adding a new employee:

1. Click the ADD USER & SEND INVITATION button to add the new employee and send them an invitation to install the Teramind Agent.
2. Click the ADD USER button to just add the user without sending an invitation.

If you are editing an existing employee:

1. Click the RESEND INVITATION button to send the employee an invitation to install the Teramind Agent.
2. Click the APPLY CHANGES button to save any changes you have made to the profile.

Importing Employees

1. Click the IMPORT button near the top of the Employees screen. You will be taken to the Import employee screen.

2. Click the UPLOAD CSV FILE button to upload a CSV file containing employee information.
3. If you want, you can click the DOWNLOAD SAMPLE CSV button to download a sample CSV file that shows you how the CSV file containing a list of employees should be formatted for importing into Teramind.
4. Additionally, there is a table at the lower part of the screen that shows what CSV fields Teramind can import, their expected values and which fields are mandatory.
5. Turn on the Invite users by email to send out invitations to install the Teramind Agent to the newly added employees.

Employee Action Menu

You can perform various actions such as lock/unlock a user, delete/restore their profile or enable/disable monitoring for them.

1. Click the check mark in front of the employee names to select employees.
2. From the top-left corner of the screen, select the action you want to perform. Here are the actions you can perform:
3. Lock: locks a user’s computer. The Status column on the employees list will change to show it as locked. When a computer is locked, the user will not be able to use it.
4. Unlock: unlocks a user’s computer previously locked by the Lock menu option or by a rule’s ‘Lock Out User’ action.
5. Delete: deletes the selected user. Note that, when you delete a user, they are not permanently deleted, just hidden from the employee list and all monitoring reports. If you are on a Cloud deployment, deleting a user will also free up a license.
6. Restore: restores previously deleted employee(s).
7. Enable Monitoring: enables monitoring for a user.
8. Disable Monitoring: disables monitoring for a user. The Monitored column will change to show the user is no longer being monitored.
9. Bulk Edit: allows you to edit the profile information of the selected employees in bulk. Clicking the button will open the Bulk edit window where you can make the changes that will apply to the selected employees:

Viewing an Employee’s Monitoring Reports

If you click an employee name from the list of employees, you will be taken to the Employee’s page where you can see their detailed reports such as, Activity Log (similar to the Applications & Websites), Session Log, Time Worked, Alert Log etc.

These reports are similar to the other monitoring reports except for the Time Worked screen:

1. The Time Worked screen shows slightly different information compared to the Productivity Reports. It shows Task, Work Time, Activity, Idle, First Launch and Total salary/wage.
2. You can also edit the employee’s profile or turn off their monitoring settings from this screen.

Editing / Deleting an Employee

1. Click the EDIT INFO button from the Employee’s page. A pop-up window will open where you can edit their profile information. Check out the Entering / Editing Employee Profiles section to learn how to edit the profile.
2. Click the small, Red Trash Can icon to delete the employee. You can also delete/restore an employee from the Employee Action Menu. Note that, when you delete a user, they are not permanently deleted, just hidden from the employee list and all monitoring reports. If you are on a Cloud deployment, deleting a user will also free up a license.

Computers

Introduction to the Computers

The Computers screen shows all the computers you have added to Teramind, when they were last seen, online counts, currently online users/agents, IP addresses, operation systems, client (Teramind Agent) versions and FQDNs (Fully Qualified Domain Names).

Note: if you do not see a column, click the Settings  button near the top-right corner of the report to enable it.

Accessing the Computers Menu

1. Click the COMPUTERS menu to access its screen.

Remote Installing the Teramind Agent

1. Click the REMOTE INSTALL AGENTS button near the top-right corner of the screen. You will be taken to the Remote Agent Installation screen where you can deploy the Agent remotely.

Computer Action Menu

You can perform various actions such as enable/disable monitoring, enable offline notifications, update the Agent etc.

1. Click the check marks in front of the computer names to select computers.

2. From the top-left corner of the screen, select the action you want to perform. You can choose from the following actions:
   • Enable Monitoring: enables monitoring for all users on the selected computers.
   • Disable Monitoring: disables monitoring for all users on the selected computers.
   • Delete: Delete / remove a computer. Note that, when you delete a computer, it is not  permanently deleted, just hidden from the computers list and all monitoring reports. Monitoring is also disabled when you delete a computer. If you are on a On-Premise deployment, deleting a computer will also free up a license.
   • Restore: Restore a previously deleted computer. Note that since deleting a computer also disabled monitoring for a computer, you will need to enable monitoring after you restore it.
   • Enable notify when offline: when you click this button, you can specify one or more email addresses which will get an email notification whenever the selected computers go offline.
   • Disable notify when offline: disables offline notification.
   • Uninstall Agent from PC: will uninstall/remove the agent from the computers.
   • Update agents: updates the installed Teramind Agent on the selected computers with the latest version.
   • Cancel agents update: cancels any pending Agent update tasks.

Accessing a Computer’s Details Page

Click on a computer from the list of computers on the Computers page. You will be taken to the Computer’s details page:

From this page you can view the computers details such as what OS is installed, the IP address, Agent version etc. You can also perform many of the same tasks found on the Computer Action Menu such as enable/disable monitoring, delete a computer, update agent etc. However, there are two new options you can access from the Computer’s details page: viewing/editing the computer’s profile and exporting session recordings. See the sections below for more information.

Exporting Session Recordings of Users/Agents on a Computer

Click the Video Camera  icon on a Computer’s details page to export session recordings of select users/agents on the computer. Clicking this button will open a Video params window:

From this window you will be able to specify export date and time, select agents/users and other parameters for exporting the video/session recordings. See the Session Player section to learn more about session recordings.

Editing a Computer’s Settings

Click the EDIT INFO button on a Computer’s details page to access its settings:

You can change the following settings from the Computer settings window:

• CLEAN PRINT SPOOL (FOR PRINT SERVERS): This option is available when the Teramind Agent is installed on a print server. When Clean Print Spool is enabled, the Teramind Agent will check the print spooler every 10 minutes and delete documents older than 6 hours.
• NOTIFY WHEN OFFLINE: When you click this button, you can specify one or more email addresses which will get an email notification whenever the selected computers go offline. Note that, same option is available under the Computer Action Menu.
• OVERRIDE: DELETE RECORDINGS OLDER THAN …: This option lets you delete recording older than certain days. A value other than 0 will override the delete settings you have specified in the ‘DELETE HISTORY AFTER…’ field on the Monitoring Settings > Screen

Configure > Departments

Introduction to the Departments

On the Departments screen, you can see a list of all the departments, how many employees are in each department, who the department managers are etc. You can also create/edit departments and assign managers to them.

Accessing the Departments Menu

1. Hover your mouse over the CONFIGURE menu, then
2. Select Departments from the sub-menu.

Creating a New Department

1. Click the NEW DEPARTMENT button. A New department window will pop-up:

2. Specify a name and optionally, a description. Select the department managers from the list of employees.
3. Select the employees for the department. You can also assign a employee to this department later. Check out the Assigning an Employee to a Department section below to learn how. 
4. Click the APPLY CHANGES button to create the department.

Viewing the Employees in a Department

1. Click on the name of a department, for example, Sales. You will be taken to the Department page.

2. On the left side of the Department page, you will see a list of employees assigned to the department.
3. Check out the Entering / Editing Employee Profiles section to learn how to assign an employee to a department.
4. On the right-side of the page, you will see a Gantt chart with a list of tasks for each employee and how much time they spent on each task. Check out the Rules Editor > Actions tab section, under ‘Set User’s Active Task’ to learn how tasks can be assigned to an employee automatically by a rule when using a Stealth Agent. Or, check out the How to use the Revealed Agent article to learn how Tasks can be created and self-assigned by users with the Revealed Agent.

Assigning an Employee to a Department

You can assign an employee to a department when creating a department. But you can also change an employee's department from the employee's profile:

1. Select the EMPLOYEES menu.
2. Click on an employee's name to open their page.
3. Click the EDIT INFO button.
4. You can change the Department for the employee under the PERSONAL INFO tab:

Editing / Deleting a Department

1. While on the Department page, click the EDIT button at the top-right corner. An Edit department window will appear (similar to the New department window) where you can change the department’s name, description and managers.
2. While on the Department page, click the DELETE button at the top-right corner to delete the department.

Configure > Schedules

Introduction to the Schedules

The Schedules screen allows you to manage schedules for your employees and contractors. You can control employee work time, lunch breaks, days off etc. This information is then used by other Teramind modules. For example, in the Agent Schedule-based rules, in the Productivity Reports or for calculating payroll etc.

This screen has two tabs. The SCHEDULING tab allows you to create/edit the  daily and weekly schedules for your employees. The TEMPLATES tab allows you to create/edit templates to make managing schedules for large groups easier.

Accessing the Schedules Menu

1. Hover your mouse over the CONFIGURE menu, then
2. Select Schedules from the sub-menu.

Adding a New Employee

1. Click the NEW EMPLOYEE button near the bottom. This will pop-up the New employee window where you can add a new employee, configure their account details, monitoring options, etc. Check out the entering/editing employee profiles section for more information.

Combined vs Daily Schedules

1. Click the COMBINED or DAILY button near the top-right corner to switch between a Combined view and a Daily view. On the Combined view, days with the same shift/time slots are combined in a single column while in the Daily view each shift is shown as a separate column.

Managing Employee Schedules

1. You can manage schedules for individual employees from the SCHEDULING tab.

Notifying Employees About Schedule Changes

You can send a notification to employees or departments of any schedule changes.

1. Click the NOTIFY EMPLOYEES button at the top right-corner of the SCHEDULING screen. A pop-up window will open.

2. Select the employees you want to inform from the list of employees.
3. Select a period.
4. Optionally, add a comment.
5. Click the APPLY CHANGES to send the notification.

Managing Weekly Employee Schedules

1. Click the name of an employee on the SCHEDULING screen. You can also click the ADD SCHEDULE button if the employee does not have a schedule already assigned. A pop-up window will be displayed:

2. You can select an existing template to populate the schedules for the weekdays.
3. Click on an empty Work time slider to add hours to it.
4. Drag the Circles  on a slider to adjust its hours.
5. Click on a day’s name, for example, Tuesday, to turn it on/off (make it a workday/off day). If all the days are turned off for the week, the schedule will be deleted/removed from the employee.
6. Use the Allowed break field to assign break hours.
7. Click the Matched List icon to make all hours match with the first day’s hour.
8. Click the APPLY CHANGES button to save the schedule.

Managing Daily Employee Schedules and Day Offs

1. Click on a day’s time slot/shift or an empty day on the SCHEDULING screen. A pop-up window will appear:

2. You can edit the work time and breaks the same way you do for multiple days.
3. You can delete the shift (turn the day off).
4. To assign/cancel a day off, click the SET DAY OFF or DEACTIVE DAY OFF.
5. Click the APPLY CHANGES button to save the changes.

Batch Schedule Editing

This feature allows you to add a schedule to a group of employees at once instead of editing them one by one.

1. Click the BATCH SCHEDULE EDITING button near the top right-corner of the SCHEDULING screen. An Edit schedule pop-up window will open.

2. This is similar to editing a Weekly Employee Schedule, the only additional option is an Employees field where you can select and assign multiple employees to the schedule.

Schedule Templates

Adding a New Schedule Template

1. From the TEMPLATES tab, click the ADD TEMPLATE button at the top-right corner. A pop-up window will open:

2. Give the template a name.
3. You can edit the rest of the template the same way you would edit a weekly employee schedule. Please follow the Managing Weekly Employee Schedules to learn how to edit the schedule.

Editing / Deleting a Schedule Template

1. Click on a template name. A pop-up will open.

2. Change the template name if needed.
3. You can edit the template the same way you would edit a weekly employee schedule. Please follow the instructions on Managing Weekly Employee Schedules to learn how to edit a template.
4. Click the Trash Can icon to delete the template. You can also click on the day names (i.e. Monday, Tuesday etc.) to turn them off. If all the days are turned off for the week, the template will be deleted/removed.

Configure > Positions

Introduction to the Positions

The Positions screen allows you to manage schedules for positions/titles. It is very similar to the Schedules screen except that it does not have any Notify Employee or Batch Update option.

Accessing the Positions Menu

1. Hover your mouse over the CONFIGURE menu, then
2. Select Positions from the sub-menu.

Adding / Editing / Deleting a Position

1. Click the NEW POSITION button to add a new position. Note that, you can also create a new position when entering/editing employee profiles, under PERSONAL INFO, in the Position field.
2. Hover over a position name and click the Pencil  icon to edit the position.
3. Hover over a position name and click the Trash Can  icon to delete the position.

Managing Position Schedules

You can manage schedules for positions the same way you manage schedules for employees. For example:

1. You can create/edit the daily schedule by clicking a day on the scheduler.
2. Similarly, you can create/edit weekly schedule of a position by clicking the position name or by clicking the ADD SCHEDULE FOR POSITION button.

Check out the Managing Daily Employee Schedules and Day Offs and the Managing Weekly Employee Schedules sections to learn how to edit the two types of schedules.

Using the Schedule Templates

You cannot create any schedule templates from the Position screen. However, you can use any templates created on the Schedule screen when editing a weekly position schedule.

Configure > Access Control Policies

Introduction to the Access Control

The Access Control screen allows you to control which users/managers have access to what information on the Teramind Dashboard and the settings they are allowed to change. On Teramind, access control is implemented through policies. A policy is composed of the following elements:

• Privileged Users: They are the users/managers who monitor certain groups of people (Target Users/Subjects). 

• Target Users / Subjects: These are the users monitored by the Privileged Users.
• Permission: Defines what the privileged user can do with the information of the Target Users under their responsibility. The permission is grouped into Play, View, Edit and Access Widgets categories.

The main window of the Access Control screen shows a list of policies, privileges and the subjects they manage. You can create a new policy or edit an existing one from this window.

Accessing the Access Control Menu

1. Hover your mouse over the CONFIGURE menu, then
2. Select Access control from the sub-menu.

Creating a New Access Control Policy

1. Click the New policy button at the top-right corner of the Access Control screen. A window will pop-up.

2. Enter a name for the policy, select the privileged users (for example, Department Managers) the policy will apply to then click the SAVE button. You will be taken to the Create policy screen. Continue with the Access Control Policy Editor section below to learn how you can assign target users and adjust the permission settings for a policy.

Viewing / Editing / Deleting an Access Control Policy

1. Click on a policy from the list of policies on the main Access Control screen. You will be taken to the View policy screen where you can see the details for the policy.

2. On the View policy screen, click the EDIT button to edit the policy. You will be taken to the Edit policy screen. Continue with the Access Control Policy Editor section below to learn how to edit the policy.
3. On the View policy screen, Click the DELETE button to delete the policy.

Access Control Policy Editor

The Access Control Policy Editor allows you to edit a policy. You access it through the Create policy / Edit policy screens (see the previous sections to learn how to create/edit a policy).

1. Specify a policy name and select the privileged users (for example Department Managers) the access permission will be granted to.
2. Click the Create permission button to create a new permission.
3. Click the Select all targets button to select all target users or the Deselect all targets button to deselect them.
4. Click the Show all link to show all users or the Show only selected link to show only selected target users.
5. Click on a target user’s name to select/deselect them.
6. Click the Select all permissions button to select all permissions or the Deselect all permissions button to deselect them.
7. Click on a permission category to expand or collapse it.
8. Click on a permission item to select/deselect it. See the List of Access Control Permissions table below for an explanation of each permission item.
9. Click the Save changes button to save the policy.

List of Access Control Permissions

<your instance>/#/reports/storage

https://acme.teramind.co/#/reports/storage

Configure > Productivity Profiles

Introduction to the Productivity Profiles

Productivity profiles allow you to create rules to classify productive and unproductive applications and websites and assign them to individual employees, groups or departments. The profiles determine how Productivity Classification, Productive Time, Unproductive Time, etc. are measured and reported on the BI Reports (for example, BI Reports > Productivity and the BI Reports > Applications & Websites).

Accessing the Productivity Profiles

1. Hover your mouse over the CONFIGURE menu, then
2. Select Productivity profiles from the sub-menu.

Viewing and Managing Productivity Profiles

1. To filter profiles: You filter the list of displayed profiles using the Search field and/or the Filter by assignments list.
2. To view all child profiles: If a profile has any child profile(s) you can click on its Up Arrow /Down Arrow icons to view or hide its child profiles.
3. To change the parent of a child profile: Click the Inheritance  button to change the parent of the profile.
4. To delete a profile: Click the Delete  button to delete / remove a profile.

Adding a Productivity Profile

1. Click the Add child profile  button at the right side of a profile to add a new child profile under it. A pop-up window will open:

2. Enter a PROFILE NAME.
3. Select the employees/departments the profile will be ASSIGNED TO.
4. Click the CREATE button to create the profile. You will be taken to the Edit productivity profile screen. Check Step 2-4 of the Editing Productivity Profiles and Classification Rules section below to learn how to configure a rule.

Editing Productivity Profiles and Classification Rules

1. Click a profile’s name to edit it. You will be taken to the Edit productivity profile screen:

2. Click the Pencil  icon next to the profile’s name to edit its name and change its assignment. Note that, you can only assign one productivity profile to a user. If they are already part of a productivity profile, assigning them to a new profile will remove them from the previous profile.
3. You can change what rules are displayed by using the Search, Productivity, Type and Inheritance
4. Click the Pencil  icon next to a rule to edit it (see below for more information).
5. Click the Delete  icon to delete a rule. You can only delete a rule ‘owned’ by the profile.
6. Click the Open Parent  icon to leave the edit screen of the child profile and go to the parent profile screen.
7. Click the Click the Override  icon to create a copy of an inherited You can then save the inherited rule as a new owned rule.
8. Click the ADD NEW RULE button to create a new rule. The filter area will change to let you enter the details for the rule:

9. Select a type of rule. You can choose from Activity, Regexp and Category.
10. Enter a value for your chosen rule type. The value will apply to website URLs and application file names. For Activity type rules, you can enter any text. For example: com, word.exe etc. , Regexp will match with a regular expression¹. For example, .*\.outlook\.com. With Category type rules, you can select from a predefined list of websites categories². For example: Entertainment, Social Media etc.

11. Select a productivity classification such as Productive, Unproductive or Unclassified.
12. Click the CREATE RULE button to create and save the rule or X button to cancel.

Reset Classifications / Retroactive Classifications

You can retroactively apply new classification profiles and rules to previous employee activities:

1. Click the Reset classifications menu near the top-right corner. Select a reset option from the pull-down list.
2. You can see when the profiles were last synced near the reset menu.

Configure > Shared Lists

Introduction to the Shared Lists

The Shared Lists screen allows you to build a list of items that can be reused throughout Teramind. You can build lists of websites, IP addresses, program names, and more. These shared lists can be used when defining behavior rules, as well as in monitoring settings.

You can see all the existing lists including their name, type, number of items in the list etc. You can create, edit or delete shared lists from this screen.

Accessing the Shared Lists Menu

1. Hover your mouse over the CONFIGURE menu, then
2. Select Shared lists from the sub-menu.

Creating / Uploading a Shared List

1. On the Shared List screen, click the Create list button near the top-right corner of the Shared List screen. A window will pop-up.

2. Enter a name for the list.
3. Select a list type. You can choose from Text, Regular Expressions and Networking types. Text list is useful for simple data such as names, website URLs etc. Regular Expressions is a powerful list type that can be used to detect patterns and specially formatted text such as credit card numbers, zip/postal codes etc. Networking list types are used for defining IP addresses and ports. Network lists can be used with the Network-based rules or to control Network monitoring settings.
4. Click the Create List button. You will be taken to a screen where you can add list items or upload a file.

5. Click the add file button to upload a .CSV or .TXT file containing your list item. Each item should be in a separate line in the file for Teramind to import it correctly.
6. You can also click the Add new row button to enter items manually one by one.
7. If you’ve entered an item manually, click the Save button to save it.

Editing / Downloading a Shared List

1. On the Shared List screen, click the Pencil button at the right side of a shared list. You will be taken to a screen where you can edit the list.

2. To download a copy of the list, replace the list or to append news items to a list from a file; click the Download list file button.
3. To add a new item/row, click the Add new row button.
4. To edit an item/row, click the Pencil button.
5. To delete an item/row, click the X button.

Deleting a Shared List

1. On the Shared List screen, click the Trash Can button at the right side of a shared list to delete/remove it.

System > Missing Users / Computers

Introduction to the Missing Users / Computers Report

The Missing Users / Computers report shows employees or computers for which Teramind didn’t receive any data recording for the specified days. The report shows the following columns: Employee/computer, Last login time, Last login from  and Consecutive days without recording.

Accessing the Missing Users / Computers Menu

1. Hover your mouse over the SYSTEM menu, then
2. Select Missing users / computers from the sub-menu.

Searching for Missing Users / Computers

1. Select from Employees/Computers from the top-left corner of the screen.
2. Specify number of days for DATA RECORDED WITHIN field.
3. Specify number of days for AND NO RECORDING FOR THE LAST field.
4. Click the APPLY button to apply the filter and view the result.

i	You can use the dashboard's Notifications feature to diagnose the most common reasons for missing computers / users. Or, check out the Employee showing offline / Computer not reporting troubleshooting article to learn more.