The Behavior Policies screen allows you to view, create, and manage behavior policies and rules.

A policy is like a container or folder that contains rules.

A rule allows you to set up conditions to detect harmful, dangerous, or unproductive behavior in real-time and, optionally, take automated action (such as warning the user, blocking the activity, notifying an admin, etc.). You can see the rule violations report from the Behavior Alerts dashboard.

1. Search (by Name): Filters the list to policies and rules whose names contain the text you type.

2. Preset Filter (Enabled): A quick filter that narrows the list by status. Select Yes to show only enabled policies and rules, No to show only disabled ones, or clear the filter to show everything.

3. Expand/Collapse All Policies: Click the Expand/Collapse icon to explan every policy in the list to reveal its rules, or collapses them all back to a compact view.

4. New Rule: Opens the Rule Editor to create a new rule. See Creating a New Rule.

5. New Policy: Opens the policy editor to create a new policy. See Creating a New Policy.

6. Filters: Opens the dashboard filters panel, where you can filter the list by additional criteria (such as tags). A counter on the button shows how many filters are active, and frequently used filters can be pinned to the toolbar next to the Name and Enabled fields.

7. Grid Menu: Click the Grid icon to choose which columns the policies and rules table displays.

8. Dashboard Actions Menu: Click the Three Dots ⋮ near the top-right corner of the screen to access the dashboard context menu. From the context menu, you can:

9. Policies Columns: each policy row shows:

10. Rules Columns: when a policy is expanded, each of its rules shows:

11. Policy Context Menu: Click the Three Dots ⋮ in front of a policy to access its context menu. From the context menu, you can:

12. Rule Context Menu: Click the Three Dots ⋮ in front of a rule to access its context menu. From the context menu, you can:

13. Expand/Collapse Individual Policies: The chevron () in front of a policy's name expands just that policy so you can see and manage its rules; click it again () to collapse it. While a policy is expanded, a New Rule for this Policy button at the bottom of the policy lets you create a rule directly under the policy.

1. Click the New Policy button on the Configurations > Behavior Policies screen. A panel on right will open:

2. Enter a name for the policy in the Policy Name field.

3. From the Assigned field, select the policy targets (employees, departments, computers, etc.) to track.

4. Optionally, you can exclude targets from the Excluded field. This is useful in certain situations. For example, suppose you want to monitor most employees in the "Sales" department but exclude a few. In that case, you can select the department in the Assigned field and select the employees you want to exclude in the Excluded field.

5. Click the Save button to create the policy.

You can start a new rule from anywhere on the Behavior Policies screen:

All three open the Rule Editor:

The Rule Editor is a step-by-step wizard:

1. Rule Steps: The left panel lists the steps: General Settings, Employees, one step for each Type of Activity or Type of Content you select, and Actions.

2. Editor Area: As you select or progress through each tab, the middle area of the screen is where you configure the rule criteria, detection conditions, and logic.

3. Rule Summary: The panel on the right updates live as you configure the rule.

4. Continue/Cancel/Submit: Click Continue at the bottom right of the editor to move to the next step, or Cancel next to it to exit without saving. On the final step (Actions), the Submit Rule button appears in the same spot once all required fields are complete; click it to save the rule.

5. Enable Rule/ Save as Draft: In the top-right corner, the Enabled toggle controls whether the rule is active, and Save as draft saves an unfinished rule so you can come back to it later.

The General Settings tab is where you define what the rule is and what it detects: its name and description, the policy it belongs to, the rule type, the types of activity or content it monitors, its violation severity, and the hours it is active. Fields marked with * are required.

1. Start from a template (optional): Pick a template if you don’t want to start from scratch. Teramind comes with dozens of templates for various use cases and vectors such as data loss prevention, applications, file operations, etc. A template fills in the conditions and actions for you; your rule name and tags are kept.

2. Rule Name (required): Give a name for the rule.

3. Rule Description (optional): Enter a description.

4. Parent Policy (required): Select the policy the rule belongs to. It’s preselected when you start the rule from a policy.

5. Rule Type (required): Select Activity to detect and control employee activities, such as restricting app or website usage; Content Sharing to protect sensitive data, such as blocking an email that contains personally identifiable information; (requires Teramind DLP or above); or Schedule to detect discrepancies in employee schedules or workflow, such as a notification when an employee is late.

6. Tags: Pick existing tags from the dropdown, or type a name and click Add Tag to create one. Tags help you find and filter rules, including on the Behavior Alerts dashboard.

7. Select Type of Activity / Type of Content: For Activity rules, select an activity type, such as: Webpages, Applications, OCR, Keystrokes, etc. Each type you turn on gets its own step in the wizard. For Content Sharing rules, select a type of content to detect, such as: Clipboard, Files, Emails, etc.

8. Rule violation severity: Drag the slider or enter a number from 0 to 100. This risk value feeds risk analysis on dashboards such as Insights.

9. Time when rule is active: The rule stays active 24 hours by default. Drag the two handles on the time bar to adjust the hours, and use + to add more time slots. The schedule follows the dashboard's timezone (Configurations > Settings > Locale).

The Employees tab is where you choose the rule's target audience: which employees, departments, computers, or AD groups the rule applies to, and optionally which ones it excludes. By default, the rule inherits its targets from the parent policy.

1. Inherit targets from Parent Policy: By default, the rule inherits its targets from the parent policy. Turn this option off to set rule targets manually:

a. Enter targets (employees, departments, computers, AD groups) in the Assign to field.

b. Optionally, exclude some with Exclude from rule.

Each Type of Activity or Type of Content you turned on gets its own step, where you build the rule's detection logic. The step's header describes what that type detects (for example, Webpages detects web browsing activities through URL, title and query arguments and browsing-related timing).

The step starts with one condition block; click New condition at the bottom to add more.

1. Activity/Content: Depending on what you selected under the Select the type of activities/Select the type of contents section in the General Settings tab, you will see different activity/content (e.g., Webpages, Applications, etc.) tabs on the left side of the Rule Editor.

2. Condition Blocks / Definition Blocks: A condition block holds a set of Rule Criteria, their values, and logic. To add a new condition block, use the New condition button. You can reorder blocks with Move Up / Move Down, or remove a block with the X button located at the top-right corner of each block. Note: Schedule rules and the Content tab on Content Sharing rules use Definition Blocks instead. For more information, see the Understanding Common Rule Elements > Condition Blocks and the Understanding Common Rule Elements > Definition Blocks sections of the Rules Guide.

3. Rule Criteria: These are the detection parameters of the rule. Click + Add inside a condition block to pick from the criteria available for that type. For example, a Webpages rule offers Webpage URL, Webpage Title, Query argument name, etc.; an Emails rule offers Mail From, Mail To, Mail Body, and so on. Each new criterion is added as a tab to the condition block. To switch between criteria, just click its tab. Remove a criterion with the X button next to its tab. Most criteria also have an Except field, so you can exclude specific values from matching (for example, detect all sites except “google.com”). Exclusions show in the Rule Summary as "excludes". For more information, see the Understanding Common Rule Elements > Rule Criteria section of the Rules Guide.

4. Condition Fields: Each criterion comes with one or more fields and a match type, such as Contains, Equals, or Matches List (which references your Shared Lists). Depending on the criterion, you fill in text values, pick radio or checkbox options, select from predefined lists, or enter numbers with comparisons such as ">=" or "<". For example, Time Active (min) with ">= 30" triggers when a webpage stays active for 30 minutes. For the full list of match types and field options, see the Understanding Common Rule Elements > Condition / Definition Fields section of the Rules Guide.

The Actions step specifies what the system will do when the rule is violated. Turn an action on with its toggle and fill in its settings. The Rule Summary lists your enabled actions in plain form, for example "Warn with message Sensitive data detected. and Notify Alex Jones".

1. Basic: the standard set of actions, described under 3 below.

2. Advanced: opens the advanced mode, where you add risk thresholds so the rule can escalate: different severities and different actions as violations accumulate.

3. Select Action(s): Select one or more actions Teramind will perform after detecting the rule violation. Turn on the actions you need to configure them:

What actions are available depends on the rule type, and some combinations are not allowed; the editor marks those directly (for example, "Cannot be combined with Warn").

The Rule Summary panel on the right side of the rule editor shows an overview of the rule, one entry per step, with the criteria, conditions, and options you selected. It also alerts you to errors, such as a missed mandatory field. Sections expand automatically as you move through the steps, and you can expand or collapse them manually.

Tags help you organize rules and filter them, both on the Behavior Policies screen and on the Behavior Alerts dashboard. To create or edit tags:

1. Click the Three Dots ⋮ located near the top-right corner and then select Edit Tags. The Edit Tags panel will open:

2. New Tag: Type a name in the Tag Name field and click Create. The tag is added to your existing tags and becomes available everywhere tags are picked.

3. Existing tags: Every tag is listed with an editable name field and two actions:

a. Rename: Edit the tag's name, then click Rename. The button stays inactive until you actually change the name. Renaming updates the tag everywhere it is used.

b. Delete: Click the Trash Can icon to delete a tag. A confirmation message will appear. Click the Delete button under the message to delete the tag. If the tag is not used by any rule, it is deleted right away. If any rule is using the tag, the delete is rejected and an error message is shown at the top of the panel. To delete such an active tag, tick the Detach from rules that use it before clicking Delete. Click Keep if you change your mind and keep the tag.

4. Assign to rules: You can tag or untag rules in bulk without opening them. Pick one or more rules in the Rules field, pick a tag in the Tag field, then click Add to selected or Remove from selected. Rules that already carry the tag are skipped when adding.

5. Click Done when you are finished.