Teramind’s Rules Engine has some advanced features that let you create sophisticated insider threat detection, data loss prevention, and productivity-related rules. In this article, we will discuss how you can leverage some of these advanced features. For more information about policies and rules, check out the Teramind Rules Guide.

Rule logic binds two or more Condition Blocks, Condition Fields, Criteria or Content Definitions together.

Rule conditions can either have an “OR” logic or an “AND” logic.

1. Each value in a rule condition is considered as an “OR” logic. In the above example, the rule will trigger in Condition 1 if the “Application caption' matches with value “Excel” or the value “Notepad'.

2. Each rule criterion is considered as an “AND” logic. In the above example, the rule will trigger if in Condition 1, the criterion “Application caption” matches 'Excel' and the criterion “Application name” matches 'excel.exe'.

3. If you have multiple condition blocks, each new condition block is considered as an “OR” logic. In the above example, if either Condition 1 or Condition 2 meets the criterion, the rule will be triggered.

4. If you use multiple rule types (e.g., Applications, Files, etc.), then each rule type is considered an OR condition. Each rule type is evaluated independently. Meaning the rule will trigger if any of the rule types’ conditions are met. You can see how the rule type condition logic relates to each other in the Rule Summary section.

When creating a Content Sharing rule and you have multiple content definitions, you can use logic to bind the definitions together. You can do so under the Advanced logics section of the Content tab.

Click on the logic between two conditions, and a pop-up menu will appear where you can select a logic out of four options:

You can see how the content definition logic relates to each other in the Rule Summary section.

The table below explains each type of logic and how they are evaluated:

Shared Lists allow you to build a list of items that can be shared across rules and configuration settings.

You can create/import and manage Shared Lists from the Configurations > Shared Lists screen. You can build lists of text/keywords, regular expressions, and network addresses/IP addresses.

Shared Lists allow you to detect a large amount of data without having to enter them every time you create a rule. For example, to block access to inappropriate websites, you can create a text-based Shared List containing those sites. They also make it easy to update the rule detection criteria without editing the rules.

Note that, not all rule conditions support the Shared Lists. For the rule conditions that support it, you can select either the matches list or equals list option and then select a Shared List from the list of available Shared Lists. The matches list option will detect any partially matched items while the equals list will detect only exactly matched items.

A regular expression (also known as regex or regexp) allows you to detect text using a pattern. It’s a powerful tool that allows you to define complex definitions to find sensitive information such as credit card numbers, invoice numbers, social security numbers, and other texts that follow a pattern or expression. Explaining the full scope of the regular expression is beyond this article. However, there are many online resources you can use to learn about regular expressions. Here, we will show you some quick tips and examples so that you can begin to learn and experiment with them.

Teramind supports regex in rule conditions, configuration settings such as monitoring settings, OCR searches, etc. You can also create a list of regular expressions through the Shared Lists.

You can use regular expressions in a rule in two ways:

The following table lists some of the most commonly used regular expressions including syntax, symbols, range modifiers, special characters, etc.:

In the Advanced mode on a rule's Action tab, you can set up risk thresholds and severity levels for a rule. This allows you to add multiple thresholds, assign different risk levels, and trigger various actions based on how often a rule is violated.

For example, you could create a Files rule that:

The risk levels you define in this mode are used to calculate the overall risk score, which is reflected in places like the Risk column on the Behavior Alerts dashboard.

1. From the Choose time period for threshold list, select the desired time period for your thresholds (e.g., Hourly, Daily, Monthly).

2. In the Choose maximum numbers of saved alerts per day field, enter the maximum number of alerts that can be triggered for this rule in a single day. If the number of alerts exceeds this limit, Teramind will not save any further alerts, and they will not appear on the Behavior Alerts dashboard. Leaving the field empty means there is no daily limit. Setting it to 0 will prevent any alerts from being generated for the rule, though the rule will still trigger. Note that you can also set a global daily maximum for alerts in the Settings > Alerts screen.

3. Click the New Threshold button to add a new threshold. For each threshold you add, you can set the following:

a. Enter a number in the Frequency field to define how many times the rule can be violated before an action is triggered.

b. Select a risk severity from the Severity drop-down list. Your options are None, Low, Moderate, High, or Critical.

c. Click the Add button to add one or more actions.