Skip to main content

Activity Rules: What Activities Can You Detect?

  • Updated

Help Topics

 

You can specify the detection criteria for the Activity-based rules from their respective activity tab(s). For example, if you selected Webpages and Emails from the Type of Activity section (in the General tab), you will have two tabs called ‘Webpages’ and ‘Emails’ where you can add the rule conditions and values.

Webpages

Webpages activity allows you to detect web browsing activities through URL, title and query arguments and browsing-related timing (i.e. idle/active).

Webpages Rule Examples

  • Warn users when spending excessive time on social media or entertainment sites such as YouTube.
  • Restrict access to non-whitelisted/unauthorized websites but allow managers to override if needed.
  • Find out potential turnover by checking if employees are searching on jobsites. Get notified if the time spent on such sites exceeds a threshold.

Webpages Rule Criteria

The table below shows what criteria the Webpages activity supports and what conditions you can use with them.

Any

image-26__1_.png

Lets you detect if a webpage is visited.

i
 If you use this option without any other criteria, Teramind will trigger the rule anytime a webpage is visited.

Webpage URL

image-27__2_.png

Used to detect an URL (webpage address) or part of an URL.

You can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

Webpage Title

image-28__1_.png

Similar to the Webpage URL criterion, just use the webpage title instead.

Query Argument Name

image-29__2_.png

A query argument name is the portion of a URL where data is passed to a website. It usually starts with a ‘?’ or ‘&’. For example: www.contacts.com/saved?company=teramind. Here, company is the query argument name.

Using this criterion, you can create interesting detection rules. For example, by checking for the composeargument in the Gmail website, you can detect if the user is composing an email. Combining this with the Webpage URL or Webpage Title criterion, you can detect more granular activities. For example, using the text new in the Webpage URL and specifying compose in the Query Argument Name, you can tell if a user is composing a new mail or editing an existing draft.

Time Active

image-30__2_.png

Used to detect how long the user has been active on the website.

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Time Active criterion is only shown when you have already selected a Website Title or a Website URL criterion.

Time Idle

image-31__2_.png

Similar to the Time Active criterion but shows how long the user has been idle/inactive on the site.

You can enter a minute value in the CONDITION field and use the  ‘>’ logic

i
 The Time Idle criterion is only shown when you have already selected a Website Title or a Website URL criterion.

Total Time Active

image-32.png

Similar to the Time Active criterion but shows the total time active (a combination of all the active times during an entire session).

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Total Time Active criterion is only shown when you have already selected a Website Title or a Website URL criterion.

Total Time Idle

image-33__1_.png

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Total Time Active criterion is only shown when you have already selected a Website Title or a Website URL criterion.

Applications

Applications activity allows you to detect the launch of any application including the ones run from the command line interface or through the Windows Run command.

Applications Rule Examples

  • Detect and block when a dangerous application (i.e. Windows Registry Editor) or an unauthorized application is launched.
  • Warn users when spending time on unproductive applications such as games, music/video player etc.
  • Detect when anonymous browsers, such as, ‘Tor’ is used.
  • Detect when screen sharing applications, snipping tools or peer-to-peer file sharing/torrent software are used.

Applications Rule Criteria

The table below explains what criteria the Applications activity supports and what conditions you can use with them.

Any

image-34__1_.png

Lets you detect if an application is launched.

i
 If you use this option without any other criteria, Teramind will trigger the rule anytime, any application is launched.

Application Name

image-35.png

Used to detect the name or part of the name of an application. For example: ‘regedit.exe’.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based)  and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Application Caption

image-36.png

Similar to the Application Name criterion, just use the application caption instead. For example: ‘Registry Editor’.

Launched from CLI

image-37.png

Detects if an application is launched from the CLI (Command Line Interface).

Select YES or NO.

Command Line Arguments

image-38.png

Command line arguments are additional parameters, options or values passed to an application when launching it from the CLI. They usually start with a ‘/’, ‘-‘ or a space after the application name. For example:

c:\ipconfig /renew. Here, renew is an argument.

Using this criterion, you can, for example, disable certain functions of an application. For example, in the second screenshot on the left, we blocked the launch of the ipconfig application when the release or renew arguments are used. Otherwise, it will run as usual. You can only use text value with the ‘Contains’, ‘RegExp’ or exact text match conditions for the CONDITION field.

i
 The Command Line Arguments criterion is only shown when you have already selected YES for the Launched from CLI criterion.

Time Active

image-39.png

Used to detect how long the user has been active on an application.

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Time Active criterion is only shown when you have already selected an Application Name or an Application Caption criterion.

Time Idle

image-40__1_.png

Similar to the Time Active criterion but shows how long the user has been idle/inactive on an  application.

You can enter a minute value in the CONDITION field and use the  ‘>’ logic.

i
 The Time Idle criterion is only shown when you have already selected an Application Name or an Application Caption criterion.

Total Time Active

image-41__1_.png

Similar to the Time Active criterion but shows the total time active (a combination of all the active times during an entire session).

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Total Time Active criterion is only shown when you have already selected an Application Name or an Application Caption criterion.

Total Time Idle

image-42__1_.png

You can enter a minute value in the CONDITION field and use ‘=’, ‘>’, ‘>=’ logics.

i
 The Total Time Active criterion is only shown when you have already selected an Application Name or an Application Caption criterion.

OCR

The OCR detects on-screen text in real-time, even inside images or videos. It works with multi-screen setups, virtual desktops and terminal servers. By default, OCR detects English text. But you can also use few other languages (check out the Teramind Agent specifications to learn which languages are supported). Check out the Editing Screen Settings section on the Teramind User Guide to learn how to change the default OCR language.

OCR Rule Examples

  • Generate an alert when a user sees a full credit card number on the screen violating the PCI DSS compliance requirements.
  • Get notified when your employees visit sites that contain illegal or questionable content, such as: hacking, pornographic or piracy related content.
  • Detect if an unauthorized user is viewing a document that contains sensitive words.
  • Prevent steganographic data exfiltration by detecting information hidden inside images or videos.

OCR Rule Criteria

The table below shows what criteria the OCR supports and what conditions you can use with them.

On-Screen Text

image-231__1_.png

Used to specify the text to detect on-screen.

You can choose from ‘Contains’, ‘Match regexp’, ‘Match list’ with any text as conditions. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can use the EXCEPT field to do detect any text except for the ones defined in this field.

Be careful while using the EXCEPT field as it will detect all text on the screen except the ones you exclude, triggering the rule every time!

Application Name

image-92.png

Used to specify the applications in which the OCR content will be detect.

You can choose from ‘Contains’, ‘Equals’ or ‘Equals List’ with any text as conditions. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Equals List’ or ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Keystrokes

Keystrokes activity is used to detect keystrokes entered by the users in applications or websites. In addition to regular keys, you can also detect the clipboard operations (copy/paste commands), use of special keys such as the Print Screen or multiple simultaneous keypress or combo keys such as CTRL+C.

Keystrokes Rule Examples

  • Detect if someone is taking screenshots with the likely intention of stealing information.
  • Detect if an employee is using unprofessional language with a customer on live chat.
  • A user repeating easy to guess passwords, hence, creating a security risk.
  • Disable keyboard macros or select combo keys in certain applications or for some users.

Keystrokes Rule Criteria

The table below shows what criteria the Keystrokes activity supports and what conditions you can use with them.

Text Typed

image-43__1_.png

Used to detect continuous text without any word break. For example, if text typed = “password”, the rule will be triggered when the last letter ‘d’ is typed.

You can enter any text in the CONDITION field and choose the ‘Contains’ or ‘Match RegExp’ option.

Similarly, you can exclude any text you do not want to detect in the EXCEPT field.

Word Typed

image-44__1_.png

Used to detect word typed with breaks. For example, if word typed = “password” the rule will be triggered when you finish typing the word and then type separation key, such as: <Space> or ‘!’ or ‘.’ (dot).

You can enter any text in the CONDITION field and choose the ‘Contains’ option.

Similarly, you can exclude any word you do not want to detect in the EXCEPT field.

Special Key Typed

mceclip0.png

You can detect special keys such as the function keys, (i.e. F1), PrtScr or key combinations such as <Shift+P>. When you select the Special Key Typed criteria and click on the CONDITION field, Teramind will pop-up a virtual keyboard where you can select the special keys.

Application Name

image-45__1_.png

Specifies which applications will be tracked.

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based)  and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

i
 The Application Name criterion is only shown when you have already selected a Text Typed or Word Typed criterion. Also, if you use this criterion, you cannot use the Webpage URL criterion in the same condition block. However, you can use both criteria in separate condition blocks (i.e. Condition 1 and Condition 2).

Webpage URL

image-46.png

Used to detect an URL (webpage address) or part of an URL.

You can enter some text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any URLs in the EXCEPT field.

i
 The Webpage URL criterion is only shown when you have already selected a Text Typed or Word Typed criterion. Also, if you use this criterion, you cannot use the Application Name criterion in the same condition block. However, you can use both criteria in separate condition blocks (i.e. Condition 1 and Condition 2).

Files

Files activity lets you detect file operations such as access, read, write, upload, download etc. There are ten such file operations you can detect. Each operation allows you to further specify additional detection criteria. For example, the Download operation lets you detect the program, file name, URL and file size.

i

Note that Teramind cannot track the copy operation for a file from one network server to the same network server (e.g. source and destination is the same). For example, copying of a file from \\103.247.55.101\source_folder to \\103.247.55.101\destination_folder cannot be tracked. Copy to and from same local drives is detected as usual.

Also copying of an empty file cannot be tracked since it will be impossible for the system to distinguish between the file create and copy operations due to the zero size of the file.

Note that not all criteria are available for all file operations. Teramind will automatically show or hide the criteria based on which file operation you select. For example, if you select the Insert or the Eject operation, you will only see the Program and Drive criterion.

image-47__1_.png

Select a file operation by clicking the CONDITION filed. Click the Plus (+) button to add a criterion to the operation.

i
 If you choose the ‘Any’ file operation without any other criteria, Teramind will trigger the rule for any file operations.

Files Rule Examples

  • Detect/block access to sensitive folders.
  • Turn a folder or drive write proof, preventing any changes to the files in that folder.
  • Get notified when files are uploaded to Cloud sharing sites, such as, Dropbox, Google Drive etc.
  • Block files from being copied to/from removable media, such as, USB drives.
  • Prevent changes of program settings or tampering of configuration files.
  • Block certain file transfer protocols, such as, FTP.
  • Restrict the transfer of large files.

Files Rule Criteria

The table below describes the criteria you can use for the Files activity, and which file operations are supported for each criterion.

Program

image-48.png

Lets you specify in which program/app the file operation took place.

You can choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’.

Similarly, you can exclude any programs you do not want to track in the EXCEPT field.

Network Host

image-49.png

Used for network-based file operations. It detects the host name of the file operation. For example: http://sharepoint.com, ftp://filevault.net etc.

You can choose from ‘Contains’, ‘Equals’, ‘All Shares’. Or, you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any hosts you do not want to track in the EXCEPT field.

i

This criterion is not supported in: Insert, Eject, Download and Upload operations.

File Path

image-50__1_.png

Used to detect a file path, folder or extension. For example: document, c:\windows etc. File extension are used to identify a file type and usually starts with a ‘. (dot)’. For example: .doc, .pdf etc. Note: you do not need to specify the ‘.’ when entering the extension.

You can choose from ‘Contains’, ‘Equals’, ‘Exact Folder’. Or, you can check for file extensions using one of the ‘Extension Contains’, ‘Extension Equals’, ‘Extension Does Not Contain’ options.

i

This criterion is not supported in: Insert, Eject, Download and Upload operations.

Drive

image-51__1_.png

Detects the local, network or external drives.

You can choose either ‘All Drives’ or ‘All External Drives’.

i

This criterion is not supported in: Download and Upload operations.

Cloud Provider

image-52__1_.png

Used to detect the cloud provider.

You can choose from ‘All Cloud Providers’, ‘Dropbox’, ‘Google Drive’, ‘OneDrive’ or ‘Box’.

Similarly, you can exclude any providers you do not want to track in the EXCEPT field.

i

This criterion is not supported in: Insert, Eject, Download and Upload operations.

RDP File Transfer

image-53__1_.png

Detects if the file copy operation is done over an RDP (Remote Desktop Protocol) session. This happens when you connect to a remote computer and copy files to/from it.

You can select either YES or NO.

i

This criterion is only supported in the Copy operation.

Download File Name

image-54__1_.png

Lets you detect the download file name.

You can choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’.

Similarly, you can exclude any files you do not want to track in the EXCEPT field.

i

This criterion is only supported in the Download operation.

Download URL

image-55__1_.png

Similar to the Download File Name criterion but used to detect the download URL instead.

i

This criterion is only supported in the Download operation.

Download File Size

image-56__1_.png

Used to detect the size (in bytes) of the file being downloaded.

You can enter a byte value in the CONDITION field and use ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

i

This criterion is only supported in the Download operation.

Upload File Name

image-57__1_.png

Similar to the Download File Name criterion but used for Upload operation instead.

i

This criterion is only supported in the Upload operation.

Upload URL

image-58__1_.png

Similar to the Download URL criterion but used for the Upload operation instead.

i

This criterion is only supported in the Upload operation.

Upload File Size

image-59__1_.png

Similar to the Download File Size criterion but used for the Upload operation instead.

i

This criterion is only supported in the Upload operation.

Upload Via

image-60__1_.png

Lets you detect what kind of application or protocol is used for the upload operation.

You can choose from ‘FTP’, ’SMTP’, ‘Outlook’ or ‘Browser’.

Similarly, you can use the EXCEPT field to ignore any protocol/application you do not want to track.

i

This criterion is only supported in the Upload operation.

Emails

Emails activity lets you detect outgoing and incoming emails including any email attachments.

Emails Rule Examples

  • Prevent attaching files from certain location(s) such as, a folder, a network path or a Cloud drive.
  • Restrict sending of work emails from personal email accounts.
  • Prevent sending of attachments to non-business addresses.
  • Detect if a competitor is contacting your employees or vice versa.
  • Get notified if a user is sending emails with large attachments.

Emails Rule Criteria

The table below shows what criteria the Email activity supports and what conditions you can use with them.

Any

image-61__1_.png

Lets you detect if an email is sent or received. If you use this option without any other criteria, Teramind will trigger the rule anytime an email is sent or received.

i

If you use this option without any other criteria, Teramind will trigger the rule anytime an email is sent or received.

Mail Body

image-62__1_.png

Used for detecting text inside the mail body.

You can choose from ‘Contains’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail Subject

image-63__1_.png

Used for detecting text inside the mail subject.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail CC

image-64__1_.png

Detects the CC addresses in an email.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can select a Shared List and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Mail To

image-65__1_.png

Similar to Mail CC criterion but used to detect the Mail To addresses instead.

Mail From

image-66__1_.png

Similar to Mail CC and Mail To criterion but used to detect the Mail From addresses instead.

Mail Direction

image-67__1_.png

Lets you detect if the mail is being sent or received.

Select either the INCOMING or OUTGOING option.

Mail Client

image-68__1_.png

Used to specify the mail client you want to detect.

You can choose from ‘Gmail’, ‘Outlook Client’, ‘Outlook Web Client’, ‘Live.com’, ‘Yahoo Mail’, and ‘Yandex Mail’. Teramind keeps adding support for new clients so you might see more clients than mentioned here.

Similarly, you can exclude any client(s) you do not want to track in the EXCEPT field.

Has Attachments

image-69__1_.png

Used to detect if the mail has any attachment.

Select either the YES or NO option.

Attachment Name

image-70__1_.png

Used to detect the names or extensions for the attached files. A file extension is used to identify a file type and usually starts with a ‘. (dot)’. For example: .doc, .pdf etc. Note: you do not need to specify the ‘.’ when entering the extension.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text. Or, you can check for file extensions using one of the ‘Extension Contains’, ‘Extension Equals’, ‘Extension Does Not Contain’ options.

i
 The Attachment Name criterion is only shown when you have already selected YES for the Has Attachment criterion.

Mail Size

image-71__1_.png

Used to detect the size (in bytes) of the mail.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

IM – Instant Messaging

IM activity lets you detect instant messaging conversations and group chats for popular IMs such as: Facebook, Skype, Slack etc. You can detect both incoming and outgoing messages, detect the participants and search the message body for keywords or text.

IM Rule Examples

  • Restrict messages to/from select contacts.
  • Detect if a user is in contact with suspicious people or criminal groups.
  • Monitor support chat conversations to improve quality of customer service and SLA.
  • Get notified if the chat body contains specific keywords or sensitive phrases such as lawsuit threats, angry sentiments, sexual harassment etc.

IM Rule Criteria

The table below shows what criteria the IM activity supports and what conditions you can use with them.

Any

image-72__1_.png

Lets you detect if an IM is sent or received.

i
 If you use this option without any other criteria, Teramind will trigger the rule anytime an IM is sent or received.

Message Body

image-73__1_.png

Used for detecting text inside the message body.

You can choose from ‘Contains’ or ‘RegExp’ with any text. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any text/list you do not want to track in the EXCEPT field.

Message Direction

image-74__1_.png

Lets you detect if the message is being sent or received.

Select either the INCOMING or OUTGOING option.

Messaging App

image-75__1_.png

Used to specify the messaging app you want to detect.

You can choose from ‘Facebook, ‘Skype Web’, ‘Skype for Business’, ‘LinkedIn’, ‘Google Hangouts’, ‘WhatsApp Web’, ‘Slack Web’, ‘Slack’, ‘Microsoft Team Web’ and ‘Microsoft Team’. Teramind keeps adding support for new apps so you might see more clients than mentioned here.

Similarly, you can exclude any app(s) you do not want to track in the EXCEPT field.

Contact Name

image-76__1_.png

Used to detect the contacts/participants of the IM conversation.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any contacts you do not want to track in the EXCEPT field.

Browser

Browser activity lets you detect any installed browser, plugins or extensions, what they are doing or what data they are accessing.

Browser Rule Examples

  • Restrict the use of a browser such as an older version of a browser that has security flaws.
  • Block user installation browser plugins and extensions by regular users to prevent malware infection and prevent security or privacy breaches.
  • Prevent a plugin from utilizing certain permissions such as the ability to access critical proxy settings or user data.

Browser Rule Criteria

The table below shows what criteria the Browser activity supports and what conditions you can use with them.

Any

image-77__1_.png

Lets you detect if a plugin is launched/activated.

i
 If you use this option without any other criteria, Teramind will trigger the rule anytime a plugin is launched or activated.

Browser

image-78__1_.png

Used to specify the browser you want to detect.

You can choose from ‘Chrome’, ‘Opera’, ‘Firefox’, ‘Internet Explorer’ or ‘All Browsers’. Teramind keeps adding support for new browsers so you might see more clients than mentioned here.

Similarly, you can exclude any client(s) you do not want to track in the EXCEPT field.

Plugin Permissions

image-79__1_.png

You can detect what permissions the plugin is using.

You can choose from any of these conditions:

  • Proxy VPN – detects if the plugin is accessing the browser’s proxy settings.
  • Request – detects if the plugin is making a web request. This permission allows a plugin to observe and analyze traffic and intercept, block, or modify web requests.
  • User Data – detects if the plugin is accessing any user data such as cookies.

Similarly, you can exclude any permission you do not want to track in the EXCEPT field.

Printing

The Printing activity lets you detect print jobs across local or network printers. You can use criteria, such as: the document and printer and number of pages being printed.

Printing Rule Examples

  • Prevent data leaks over hardcopies by restricting what documents can be printed.
  • Warn the user about large print jobs to reduce waste.
  • Restrict how many pages can be printed in a certain printer to reduce expense when taking an expensive/color print.
  • Implement printer use policies by users/departments. For example, which departments/users can use which printer, how much or what they can print.

Printing Rule Criteria

The table below shows what criteria the Printing activity supports and what conditions you can use with them.

Any

image-80__1_.png

Lets you detect if any print job is sent to the printer.

i
 If you use this option without any other criteria, Teramind will trigger the rule anytime a print job is sent to the printer.

Document Name

image-81__1_.png

Used to specify the document names you want to detect.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any plugins you do not want to track in the EXCEPT field.

Printer Name

image-82__1_.png

Used to specify the printers you want to track.

You can choose from ‘Contains’, ‘Equals’ or ‘RegExp’ with any text as conditions.

Similarly, you can exclude any plugins you do not want to track in the EXCEPT field.

Number of Pages

image-83__1_.png

Used to detect the number of pages of the document being printed.

You can enter a page value in the CONDITION field and use the ‘=’, ‘>’, ‘<’, ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Networking

The Network activity lets you detect network activities using criteria such as the applications using the network, byte sent/received, remote host etc..

Networking Rule Examples

  • Implement network security related rules, for example, restrict outgoing internet traffic from the payment server (to comply with PCI DSS regulation).
  • Limit network access such as, disable login via RDP (Remote Desktop Protocol).
  • Implement geofencing, for example, restrict access to your EU server from the US users.
  • Get notified when abnormal network activity (i.e. sudden spike in network traffic) is detected which might indicate an intrusion.

Networking Rule Criteria

The table below explains what criteria the Network activity supports and what conditions you can use with them.

Application Name

image-84__1_.png

You can enter any text in the CONDITION field and choose from ‘Contains’, ‘Equals’ or ‘Match RegExp’. Or, you can select a Shared List (Text-based or Regular Expressions-based) and specify a ‘Match List’ or ‘Equals’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any applications you do not want to track in the EXCEPT field.

Remote Host

image-85__1_.png

Used to specify the network the remote host is connected to.

You can enter a host address (such as: google.com) in the CONDITION field and choose the ‘Match List’ option. Or, you can select a Shared List (Network-based) and specify a ‘Match List’ condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

Similarly, you can exclude any network you do not want to track in the EXCEPT field.

Remote Port

image-86__1_.png

Used to detect the port of the network connection.

You can enter a port value in the CONDITION field and use the ‘=’ logic.

Similarly, you can use the EXCEPT field to specify an exception.

Bytes Sent

image-87__1_.png

Used to specify the number of bytes sent over the network connection.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’ or the ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Bytes Received

image-88__1_.png

Used to specify the number of bytes received over the network connection.

You can enter a byte value in the CONDITION field and use the ‘=’, ‘>’ or the ‘>=’ logics.

Similarly, you can use the EXCEPT field to specify an exception.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk