Teramind’s Rules Engine has some advanced features that let you create sophisticated insider threat detection, data loss prevention, and productivity-related rules. In this article, we will discuss how you can leverage some of these advanced features. For more information about policies and rules, check out the Teramind Rules Guide.

Using Rule Logic to Bind Multiple Activities/Content Types, Criteria and Conditions in a Rule

Rule logic binds two or more Condition Blocks, Condition Fields, Criteria or Content Definitions together.

Condition Logic

Rule conditions can use either "OR" logic or "AND" logic.

1. Each value in a criterion uses "OR" logic. In the above example, Condition 1 triggers if the Application Caption equals "Excel" or contains "Notepad". The Rule Summary shows "or" between the values.

2. Each criterion in a condition uses "AND" logic. In the above example, Condition 1 triggers only if the Application Name equals "excel.exe" and the Application Caption matches one of its values.

3. If you have multiple condition blocks, each condition block uses "OR" logic. In the above example, the rule triggers if either Condition 1 or Condition 2 is met. The Rule Summary shows this as "Matches any of 2 conditions".

4. If you use multiple activity types (e.g., Applications and Files), each activity type uses "OR" logic. Each activity type is evaluated independently, which means the rule triggers if the conditions of any activity type are met. In the above example, the rule triggers if the Applications conditions are met or if a file is copied to an external drive. You can see the conditions of each activity type in the Rule Summary.

Content Logic

When you create a Content Sharing rule with more than one content definition, you can choose how the definitions are combined. You can do so under the Advanced logics section of the rule's Content step.

Click the drop-down list under Advanced logics and select one of the following options:

All of these: The rule detects content only when ALL of the definitions are met (AND logic). In the example above, Definition 1 uses the tags field from the File Properties and Definition 2 uses the title field. The rule detects files whose tags equal "CONFIDENTIAL" and whose title contains "PRIVATE", which means files that are both confidential and private.
Any of these: The rule detects content when ANY of the definitions is met (OR logic). Using the same example, the rule detects files whose tags equal "CONFIDENTIAL" or whose title contains "PRIVATE", which means files that are either confidential or private.

The formula next to the list (for example, "1 AND 2") and the Content section of the Rule Summary show how the definitions are combined.

Note: The rule editor in Teramind NextGen doesn’t support the AND NOT and OR NOT logic. Existing rules that use them keep working, but to create or change them, use the rule editor in Teramind Legacy.

Using the Shared Lists in a Rule

Shared Lists allow you to build a list of items that can be shared across rules and configuration settings.

You can create/import and manage Shared Lists from the Configurations > Shared Lists screen. You can build lists of text/keywords, regular expressions, and network addresses/IP addresses.

Shared Lists allow you to detect a large amount of data without having to enter them every time you create a rule. For example, to block access to inappropriate websites, you can create a text-based Shared List containing those sites. They also make it easy to update the rule detection criteria without editing the rules.

Note that not all rule criteria support Shared Lists. For the criteria that do, type part of a Shared List's name in the field, such as "black", and then select one of the list options:

Equals list member: Detects only values that exactly match an item in the list, such as Equals list member Blacklisted Websites.
Matches list member: Detects partial matches, such as Matches list member Blacklisted Websites. For a text list, the value only needs to contain one of the items. For a regular expression list, each item is checked as a regular expression. For a network list, addresses are matched against the networks in the list.

Using Regular Expressions in a Rule

A regular expression (also known as regex or regexp) allows you to detect text using a pattern. It’s a powerful tool that allows you to define complex definitions to find sensitive information such as credit card numbers, invoice numbers, social security numbers, and other texts that follow a pattern or expression. Explaining the full scope of the regular expression is beyond this article. However, there are many online resources you can use to learn about regular expressions. Here, we will show you some quick tips and examples so that you can begin to learn and experiment with them.

Teramind supports regular expressions in rule conditions, configuration settings such as monitoring settings, OCR searches, and more. You can also create a list of regular expressions with Shared Lists.

Rule conditions (including OCR rules) and Shared Lists use a Perl/ECMAScript-style regular expression syntax. However, searches on the OCR screen use the Elasticsearch (Apache Lucene) regular expression syntax. You can find more information about it in the Elastic documentation.

Poorly constructed regular expressions or too much use of them can have performance impact. For example, a regex based on the * (asterisk) and the + (plus sign) is usually slower.

You can use regular expressions in a rule in two ways:

1. Type the regular expression directly in the criterion field, such as (word|excel|powerpoint), and then select Regular expression match /(word|excel|powerpoint)/ from the list.

2. Type part of the name of a Shared List that contains regular expressions, such as "regex", and then select Matches list member followed by the list name, such as Matches list member Design test regex.

Regex Cheat Sheet

The following table lists some of the most commonly used regular expressions including syntax, symbols, range modifiers, special characters, etc.:

`.`	Will match a single character. For example, `.at` will match “cat”, “bat”, ”fat”, etc.
`[]`	Will match with any character in the brackets. For example, `[abc]` will match either “a”, “b”, or “c”.
`[^]`	Is the opposite of `[]`. So, `[^abc]` will find any character which is NOT “a”, “b”, or “c”.
`-`	Means a range. So, `[a-z]` will match any character in the alphabet. Similarly, `[0-9]` will find any digit.
`()`	Used to group strings/words together.
`\|`	Will match any of the words/characters in the brackets. Basically, it’s a ‘or’ statement. For example, `(john\|rick\|mark)` will find any of the three names listed.
`\`	You cannot search for special characters in a regex directly such as the `-+\/#.` characters. You will need to use `\` before using such a character. For example, use `\.` to find an actual dot/full-stop character. Basically, `\` is used to ‘escape’ the character following it.
`\d \w \s`	`\d` matches any digit, `\w` matches any digit or alphabet, `\s` is used for space. The uppercase version of these does the opposite. For example, `\D` will match anything which is NOT a digit.
*``**	Matches the preceding character/word zero or more times. For example, `abc` will match “ac”, “abc”, “abbbc”. You can use brackets with this modifier too. For example, `[abc]`, `(abc)*`, etc.
`{min,<max>}`	Matches the preceding character/word for at least the min time. For example, `a{4}` will find “aaaaa”, “aaaacbdd” but not “aaa”. You can also optionally use the <max> parameter to give it a range. For example, `a{2,4}` will match 'aa', 'aaa', or 'aaaa' but will not match “a” or “aaaaa”.
`?`	Similar to using `{0,1}`. It will match 1 time or none – making it optional. For example, `a?` will find an “a” or an empty string (“”).
`+`	One or more of the characters or expressions to the left. For example, `ab+c` will find "abc", "abbc", "abbbc", and so on, but not "ac".
`^` and `$`	`^` will find a match at the beginning while `$` will find a match at the end. For example, `^abc` will only match strings that start with the string “abc” while `abc$` will only match a string that ends with “abc”.

Regex Examples

Example 1: Matching from a List of Words

Regex	`.will be hearing from my (attorney\|lawyer\|counsel).`
Result	This regex will detect any sentence that contains one of the following phrases: will be hearing from my attorney will be hearing from my lawyer will be hearing from my counsel
Explanation	`.*` means, it will match any character (except for line terminators), any number of times. Having these two characters at the beginning and end means the system will look for the match inside a complete sentence/line. `will be hearing from my` is the fixed part of the text. It can be anything you want. `(attorney\|lawyer\|counsel)` will check to see if there is a match with any of the 3 options in the brackets.

Example 2: Finding Invoice/PO Numbers or Other Patterns

Regex	`INV[#\|\-\|\s]{0,1}[0-9]{6}[\-\|\s]{0,1}[0-9]{3}`
Result	This regex will detect invoice numbers such as: INV 123456 123 INV-123456-123 INV#123456123 INV123456123
Explanation	`INV` is the fixed part of the pattern. You can put any text here, e.g., PO, ID, etc. `[#\|\-\|\s]{0,1}` will match the pound sign, hyphen, and space (`\s`). `{0,1}` means these characters can appear once or never. `[0-9]{6}` will look for a six digit number. `[\-\|\s]{0,1}` will match the hyphen or space symbol for once or none. `[0-9]{3}` means, any 3-digit number.

Example 3: Detecting a Range of IP Addresses

Regex	`192\.168\.\d{1,3}\.\d{1,3}`
Result	This regex will detect any IP (IPv4) addresses within the range of 192.168.0.0 to 192.168.255.255. Note that, while this regex is good for simple purposes, it matches invalid IP addresses too. For example, 192.168.300.999. If you need to detect IP addresses more accurately with proper boundary checks, special ranges, etc., then you will have to use a more complex regex such as: `((25[0-5]\|(2[0-4]\|1[0-9]\|[1-9]\|)[0-9])(\.(?!$)\|$)){4}`.
Explanation	`\d{1,3}` will search for any 3 digit numbers since IP addresses consist of four sets of 3 digit numbers.

Example 4: Finding Different Spellings/Variations of a Word

Regex	`[pP][aA@][sS5$][sS5$]w[oO0]{0,1}[rR][dD]`
Result	This regex will detect the word “password” and variations of its spelling that spammers usually use for obfuscations. For example: p@ssword pa55word pa$$word Passw0rd passwrd
Explanation	The characters in the brackets mean either of them can match. So, `[pP]` will detect both an uppercase “P” or a lowercase “p”. `[aA@]` will match uppercase “A”, lowercase “a” and the at “@” symbol. `[oO0]{0,1}` means, the 6th character can be an uppercase “O”, a lowercase “o”, or a zero. The `0` in the `{0,1}` means it can be omitted too. This allows us to detect spellings like “passwrd”.

Example 5: Detecting an Email Address

Regex	`[\w\.\-]{0,25}@(yahoo\|hotmail\|gmail)\.[\w]{0,3}`
Result	This regex will detect email addresses from three different vendors and any domain. For example: [email protected] [email protected] [email protected] [email protected]
Explanation	`[\w\.\-]{1,25}` means, any character, digit or underscore (`\w`), dot (`\.`), or hyphen (`\-`) can be in the first part of the email address. `{1,25}` means, this is limited to minimum one character and up to 25 characters. `(yahoo\|hotmail\|gmail)` means, find from any of the 3 email types specified in the brackets. `[\w]{0,3}` means, the domain can be 0 to 3 characters long consisting of any characters or digits.

Using the Advanced Mode Actions/Risk Thresholds

On a rule's Actions step, the Advanced tab lets you set up risk thresholds. You can add multiple thresholds, give each one its own risk level, and trigger different actions based on how often the rule is violated.

For example, you could create a Files rule that:

Sets a Low risk level and triggers a Warn action after 2 violations in a day.
Escalates to a High risk level and triggers a Block action after 5 violations in a day.

The risk levels you define here are used to calculate the overall risk score, which is reflected in places like the Risk column on the Behavior Alerts dashboard. Alerts saved under a higher risk level add more to the score.

1. From the Choose time period for threshold list, select the time period in which violations are counted, such as Daily.

2. In the Choose maximum numbers of saved alerts per day field, enter the maximum number of alerts that can be saved for this rule in a single day, such as 10. If the number of alerts exceeds this limit, Teramind won't save any further alerts, and they won't appear on the Behavior Alerts dashboard. Leaving the field empty means there's no daily limit. Setting it to 0 prevents any alerts from being saved for the rule, though the rule still triggers. You can also set a global daily limit in Configurations > Settings > Alerts, under Alerts and limits > Maximum daily alerts count.

3. Click New threshold to add a threshold. For each threshold, you can set the following:

a. In the After [number] violation(s) field, enter how many times the rule can be violated before the threshold's actions are triggered, such as 2.

b. From the Define risk level list, select a risk level: No risk, Low, Moderate, High, or Critical.

c. Turn on the actions you want to trigger, such as Warn, and fill in their settings. For example, under Warn, enter a message such as "Copying files to external drives is restricted." Some actions can't be used together. When an action isn't available, you'll see a note such as "Cannot be combined with Warn".

Repeat step 3 to add more thresholds, such as a second threshold that blocks the activity after 5 violations with a High risk level. When more than one threshold has been reached, only the highest one applies. The Actions section of the Rule Summary lists each threshold and its actions.

How to use advanced rules techniques: multiple conditions, shared lists, regex, risk thresholds