Activity rules are useful for detecting and controlling user activities for a range of monitored systems. For example, restricting app launch, blocking websites, preventing file transfers, etc.

You can specify the detection criteria for the Activity rules from their respective activity tab(s). For example, if you selected Webpages and Emails from the Select the type of activities section (in the General Settings tab), you will have two tabs called “Webpages” and “Emails” where you can add the rule criteria, conditions, and values.

Webpages Activity rules allow you to detect web browsing activities through URL, title, browser name, query arguments, etc., and time spent on webpages.

The table below shows what criteria the Webpages Activity rules support and what conditions you can use with them.

This criterion lets you detect if any webpage is visited.

This criterion can be used to detect a URL (webpage address) or part of a URL.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any URLs by specifying them in the Except field.

To further refine which type of URL requests your rule should detect, you can use the following two options to distinguish user-initiated queries from automated or secondary resource queries, helping you avoid false positives:

Ignore background or automated requests?*:

Choose Yes to make the rule detect only direct user visits to the webpage, while ignoring any automated or background requests by embedded ads or source codes in the page.

Here’s an example:

1. Imagine you have a rule that blocks the Webpage URL “facebook.com”.

2. A user visits an unrelated website, such as “news.com”. , which has some Facebook ads.

If you enable the Ignore background or automated requests? option, the user will be able to visit “news.com” without the rule being triggered. The rule will only block direct attempts to visit “facebook.com”.

Ignore when an webpage request static content?* :

If you select Yes for this option, the rule will ignore browser requests for static content (e.g., JS, CSS, images), pages opened through an iframe, and API requests.

Here’s an example:

1. Imagine, you have a rule that blocks the Webpage URL, “imagehub.com”.

2. A user visits an unrelated website, such as “news.com”, which loads some CSS images from “imagehub.com”.

In the case above, if you enabled the Ignore when a webpage requests static content? option, the user will be able to visit “news.com” freely, but the images will not load.

This criterion is similar to the Webpage URL criterion, just use the webpage title instead.

This criterion allows you to specify one or more browsers to detect. You can choose from the list of predefined browsers. You can also enter the browser’s process name (for example, enter msedge.exe for the Microsoft Edge browser). *See the notes below for more information.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List and specify a “matches list”, or “equals list” condition.

You can exclude any browser(s) from the condition in the Except field.

A query argument name is the portion of a URL where data is passed to a website. It usually starts with a “?” or “&”. For example: "www.contacts.com/saved?company=teramind". Here, “company” is the query argument name.

Using this criterion, you can create interesting detection rules. For example, by checking for the “compose” argument on the Gmail website, you can detect if the user is composing an email. Combining this with the Webpage URL or Webpage Title criterion, you can detect more granular activities. For example, using the text “new” in the Webpage URL and specifying “compose” in the Query Argument Name, you can tell if a user is composing a new email or editing an existing draft.

This criterion can be used to detect private/incognito/anonymous browsing.

Select Yes or No under the Private mode section to define if you want to detect private browsing mode.

Any

Use this condition to detect both the website visits and resource request events.

This criterion can be used to detect how long the user has been active on the webpage(s).

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Active criterion, but detects how long the user has been idle/inactive on the webpage(s).

You can enter a minute value in the condition field and use the “>=” logic.

Time Focused = Time Active + Time Idle.

This criterion detects if a user stayed on certain webpage(s) for the specified duration. It doesn’t matter whether the user was active (e.g., keyboard/mouse is used) or idle (no keyboard/mouse activity); as long as they stayed on the webpage without switching to other webpages/tabs/windows, the condition will be triggered.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Active criterion, but detects the total active time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Idle criterion, but detects the total idle time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Focused criterion, but detects the total focused time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

Applications Activity rules allow you to detect application launches and users’ time spent in apps.

The table below explains what criteria the Applications Activity rules support and what conditions you can use with them.

This criterion can be used to detect the launch of any application.

This criterion can be used to detect the name or part of the name of an application. For example: “regedit.exe”.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any applications by specifying them in the Except field.

This criterion is similar to the Application Name criterion, just use the application caption instead. For example: “Registry Editor”.

This criterion detects if an application is launched from the CLI (Command Line Interface).

Select Yes or No under the Launched from CLI section to define if you want to detect apps launched from the command line.

This criterion detects if an application is launched with elevated permissions using Windows User Account Control (UAC).

An app is usually run as elevated when you launch it from the Windows Start menu while holding down the SHIFT+CTRL keys. Or, when you run it from the Windows Explorer with the right-click and then select the Run as administrator option. An application is also run elevated when it might make changes to the system (e.g., a software being installed for all users instead of just the current user). In such cases, Windows will invoke the UAC, and the application will be considered as running elevated.

This criterion will help enhance the security of your system, as software that usually requires admin permission might make changes to your system. It can also help you mitigate the impact of malware and prevent unauthorized privilege escalation, etc.

Select Yes or No under the Run elevated section to detect if the app was run with admin privileges.

Application arguments (also known as 'command line arguments' are additional parameters, options, or values passed to an application when launching it from the command line interface (CLI)/terminal. They usually start with a “/”, “-”, or a space after the application name. For example: “C:\ipconfig /renew”. Here, renew is an argument.

By using this criterion, you can, for example, disable certain functions of an application. For example, in the second screenshot, we blocked the launch of the ipconfig application when the release or renew arguments are used. Otherwise, it will run as usual.

You can only use text value with the “contains”, “matches regex”, or exact text match conditions for the condition field.

This criterion can be used to detect how long a user has been active on the application(s).

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Active criterion, but detects how long the user has been idle/inactive on the application(s).

You can enter a minute value in the condition field and use the “>=” logic.

Time Focused = Time Active + Time Idle.

This criterion detects if a user stayed on certain webpage(s) for the specified duration. It doesn’t matter whether the user was active (e.g., keyboard/mouse is used) or idle (no keyboard/mouse activity); as long as they stayed on the webpage without switching to other webpages/tabs/windows, the condition will be triggered.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Active criterion, but detects the total active time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Idle criterion, but detects the total idle time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion is similar to the Time Focused criterion, but detects the total focused time accumulated throughout the day.

The time will reset at the end of the day. This reset happens when the date of the last total time update differs from the current date. For the reset, the user's local time zone is followed.

You can enter a minute value in the condition field and use the “>=” logic.

This criterion can be used to detect the name or part of the name of the operating system installed on the user's computer. For example: “Windows 10”, “Windows 11”, etc. As an example, you can use this criterion to block certain apps on Windows 10 but not on Windows 11.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any operating systems you do not want to track in the Except field.

The OCR Activity rules can help you detect on-screen text, even inside images or videos. It works with multi-screen setups, virtual desktops, and terminal servers. By default, OCR detects English text. But you can also use a few other languages (check out the Teramind Agent specifications and supported platforms article on our Knowledge Base to learn which languages are supported). You can change the detection language from the OCR monitoring settings.

The table below shows what criteria the OCR rules support and what conditions you can use with them.

This criterion can be used to specify the on-screen text to be detected.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any text you do not want to track in the Except field.

This criterion can be used to specify the applications in which the OCR content will be detected.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any applications you do not want to track in the Except field.

Keystrokes Activity rules can be used to detect keystrokes entered by users in applications or websites. In addition to regular keys, you can also detect the clipboard operations (copy/paste commands), use of special keys (e.g., PrtScr, F1), and multiple simultaneous keypresses/combo keys such as CTRL+C.

The table below shows what criteria the Keystrokes Activity rules support and what conditions you can use with them.

This criterion can be used to detect continuous text without any word breaks. For example, if text typed = "confidential", the rule will be triggered when the last letter “l” is typed.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any applications you do not want to track in the Except field.

This criterion can be used to detect words typed with breaks. For example, if word typed = "password", the rule will be triggered when you finish typing the word and then type the separation key, such as: <Space> or “!” or “.” (dot).

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any applications you do not want to track in the Except field.

By using this criterion, you can detect special keys such as the function keys (e.g., F1), PrtScr, or key combinations such as <Shift+P>. You can only use the "equals" condition with the values.

Use this criterion to specify which applications to detect.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any applications you do not want to track in the Except field.

Use this criterion to specify which websites to detect. This is the same as the Webpage URL criterion under the Webpages activity.

Files Activity rules let you detect file operations such as access, read, write, upload, download, create a folder, rename a folder, etc. Each operation allows you to further specify additional detection criteria. For example, the Download operation lets you detect the program, file name, URL, and file size.

The table below shows what criteria the Files Activity rules support and what conditions you can use with them.

The first criterion you must select when creating a Files rule is the File Operation criterion. You can select from a list of operations such as Access, Access Folder, Copy, Create Folder, Delete, Rename, Write, Upload, Download, etc.

The conditions you specify in this criterion will determine which other criteria are available to you. Teramind will automatically show or hide criteria based on your selection.

For example, if you select the Insert or Eject conditions in the File Operation criterion, you can only add the Drive criterion as an additional criterion.

By using this criterion, you can specify which program(s) to detect (the app that initiated the File Operation).

You can choose from “contains”, “equals”, “match regex”, or 'matches glob' conditions.

Similarly, you can exclude any programs you do not want to track in the Except field.

This criterion can be used to detect the hostname of a network-based file operation. For example: "http://sharepoint.com", "ftp://filevault.net", etc.

You can choose from “contains”, “equals”, or “all shares”. Or, you can select a Shared List (Network type) and specify a “matches list' condition.

Similarly, you can exclude any hosts you do not want to track in the Except field.

This criterion is not supported in: Insert, Eject, Download, and Upload operations.

This criterion is similar to the Network Host criteria, but detects the source network host of a Copy or Move operation.

You can exclude any hosts you do not want to track in the Except field.

This criterion is only available with the Any, Copy, Move, and Rename operations.

This criterion can be used to detect parent folders or file extensions. For example: document, c:\windows, etc. File extensions are used to identify a file type and usually start with a “. (dot)”. For example: .doc, .pdf, etc. Note: you do not need to specify the “.” when entering the extension.

You can choose from various “contains”, “equals”, and “matches” conditions. When using one of the “match” options, you can use a wildcard such as “*”, “?”, “[abc] ”, “[a-z] ”, etc. For example, “?at” will match “Cat”, “cat”, “Bat”, or “bat”.

You can exclude any path(s) you do not want to track in the Except field.

This criterion is not supported in: Insert, Eject, Download, and Upload operations.

This criterion is similar to the File Path criteria, but detects the source folder, file name, or extension of a Copy or Move operation.

You can exclude any path(s) you do not want to track in the Except field.

This criterion is only available with the Any, Copy, Move, and Rename operations.

This criterion can be used to detect where the file operation took place, such as a local, network, or external drive.

You can enter a drive name (e.g., “C”) and select that particular drive or choose from “All drives” or “All external drives” conditions.

You can exclude any drive you do not want to track in the Except field.

This criterion is not supported in Download and Upload operations.

This criterion is similar to the Drive criteria, but detects the source drive of a Copy or Move operation.

This criterion can be used to detect the cloud provider of a file operation.

You can choose from “Any”, “Dropbox”, “Google Drive”, “OneDrive”, “Box”, etc.

Similarly, you can exclude any providers you do not want to track in the Except field.

This criterion is not supported in the Insert, Eject, Download, and Upload operations.

This criterion is similar to the Cloud Provider criteria, but detects the source cloud provider of a Copy or Move operation.

This criterion can detect if the file copy operation is done over an RDP (Remote Desktop Protocol) session. This happens when you connect to a remote computer and copy files to/from it.

Select either Yes or No under the RDP transfer section to define if RDP transfers will be detected.

This criterion lets you detect the download file name.

You can choose from “contains”, “equals”, or “matches regex”.

Similarly, you can exclude any files you do not want to track in the Except field.

This criterion is only available with the Download operation.

This criterion is similar to the Download File Name criterion, but used to detect the download URL instead.

This criterion can be used to detect the size (in bytes) of the file being downloaded.

You can enter a byte value in the condition field and use “=”, “>”, “<”, and “>=” logic.

Similarly, you can use the Except field to specify an exception.

This criterion is similar to the Download File Name criterion, but used for the Upload operation instead.

This criterion is similar to the Download URL criterion but used for the Upload operation instead.

This criterion is similar to the Download File Size criterion, but used for the Upload operation instead.

This criterion lets you detect what kind of application or protocol is being used for the upload operation.

You can choose from “Browser”, “FTP”, “Outlook”, or “SMTP”.

Similarly, you can use the Except field to ignore any protocol/application you do not want to track.

Emails Activity rules let you detect outgoing and incoming emails, including any email attachments.

The table below shows what criteria the Email Activity rules support and what conditions you can use with them.

This criterion lets you detect any email being sent or received.

This criterion can be used for detecting text inside the mail body.

You can choose from “contains” or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

This criterion can be used for detecting text inside the mail subject.

You can choose from “Contains”, “Equals”, or “RegExp” with any text. Or, you can select a Shared List and specify a “Match List” or “Equals List” condition. Check out the Shared List section on the Teramind User Guide to learn how to create shared lists.

You can choose from “contains”, “equals”, or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

This criterion detects the CC addresses in an email.

You can choose from “contains”, “equals”, or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

This criterion is similar to the Mail CC criterion, but used to detect the Mail To addresses instead.

This criterion is similar to the Mail CC and Mail To criteria, but is used to detect the Mail From addresses instead.

This criterion lets you detect if a mail is being sent or received.

You can select either the “Incoming”, “Outgoing”, or both options.

Use this criterion to specify the mail client you want to detect.

You can choose from “Gmail”, “Live”, “Outlook”, etc. Teramind keeps adding support for new clients, so you might see more clients in the future.

Similarly, you can exclude any client(s) you do not want to track in the Except field.

This criterion can be used to detect if an email has any attachments.

Select either the Yes or No option under the Has attachments section to define if emails with attachments will be detected.

Used to detect the extensions for the attached files. A file extension is used to identify a file type and usually starts with a “. (dot)”. For example: .doc, .pdf, etc. Note: you do not need to specify the “.” when entering the extension.

You can choose from “contains”, “equals”, or “matches regex” with any text.

This criterion can be used to detect the email size (in bytes).

You can enter a byte value in the condition field and use the “=”, “>”, “<”, and “>=” logic.

You can use the Except field to specify an exception or use it to define a range. For example, you can specify >=2048 in the Mail Size field and <=5120 in the Except field to detect emails between 2 MB to 5 MB in size.

Instant Messaging Activity rules let you detect instant messaging conversations and group chats for popular IMs such as WhatsApp, Slack, etc. You can detect both incoming and outgoing messages, detect the participants, and search the message body for keywords or text.

The table below shows what criteria the Instant Messaging Activity rules support and what conditions you can use with them.

This criterion can be used to detect any IM send/receive events.

This criterion can be used for detecting text inside the message body.

You can choose from “contains”, “equals”, or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

This criterion lets you detect if a message is being sent or received.

Select either the “Incoming”, “Outgoing”, or both options under the Message direction section to define what message origin will be detected.

Use this criterion to specify the messaging app you want to detect.

You can choose from “Facebook, “Google Chat”, “LinkedIn”, etc. Teramind keeps adding support for new apps, so you might see more apps in the future.

Similarly, you can exclude any app(s) you do not want to track in the Except field.

This criterion can be used to detect the contacts/participants of an instant messaging conversation.

You can choose from “contains”, “equals”, or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

Browser Plugins Activity rules let you detect any installed browser plugins or extensions and what permissions they are using.

The table below shows what criteria the Browser Plugins Activity rules support and what conditions you can use with them.

This criterion can be used to detect if any browser plugin is launched/activated.

Use this criterion to specify the browser(s) you want to detect.

You can choose from “Chrome”, “Opera”, “Firefox”, “Internet Explorer”, etc. Teramind keeps adding support for new browsers, so you might see more browsers in the future.

Similarly, you can exclude any client(s) you do not want to track in the Except field.

Use this criterion to specify the plugin(s) you want to detect.

You can choose from “contains”, “equals”, or “matches regex” conditions with any text.

Similarly, you can exclude any plugins you do not want to track in the Except field.

You can use this criterion to detect what permissions a plugin is using.

You can choose from any of these conditions:

Similarly, you can exclude any permission you do not want to track in the Except field.

Printing Activity rules let you detect print jobs across local or network printers. You can use criteria, such as the document and printer names, and the number of pages being printed.

The table below shows what criteria the Printing Activity rules support and what conditions you can use with them.

Use this criterion to specify the document name(s) you want to detect.

You can choose from “contains”, “equals”, or “matches regex” conditions with any text.

Similarly, you can exclude any documents you do not want to track in the Except field.

Use this criterion to specify the printer(s) you want to track.

You can choose from “contains”, “equals”, or “matches regex” conditions with any text.

Similarly, you can exclude any printers you do not want to track in the Except field.

This criterion can be used to detect the number of pages of the document being printed.

You can enter a page value in the condition field and use the “=”, “>”, “<”, and “>=” logic.

You can use the Except field to specify an exception or use it to define a range. For example, you can specify >20 in the Mail Size field and <50 in the Except field to detect printed documents between 20 to 50 pages.

The Networking Activity rules let you detect network activities such as bytes sent/received, hosts, apps making the network connections, etc.

The table below explains what criteria the Networking Activity rules support and what conditions you can use with them.

Use this criterion to specify the application(s) using a network connection.

You can choose from “contains”, “equals”, or “matches regex” with any text. Or, you can select a Shared List (Text or Regular Expressions type) and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any text/list you do not want to track in the Except field.

Use this criterion to specify the remote host(s) the network is connected to.

You can enter a host address (such as: "google.com") or an IP address (such as: "10.52.22.1/32") in the condition field, or you can select a Shared List (Network type) and specify a “matches list” condition.

Similarly, you can exclude any host you do not want to track in the Except field.

This criterion be used to detect the port of the network connection.

You can enter a port value in the conditions field and use the “=” logic.

Similarly, you can use the Except field to specify an exception.

Use this criterion to specify the number of bytes sent over the network connection.

You can enter a byte value in the condition field and use the “=”, “>”, or “>=” logic.

Similarly, you can use the Except field to specify an exception.

Use this criterion to specify the number of bytes received over the network connection.

You can enter a byte value in the condition field and use the “=”, “>”, or “>=” logic.

Similarly, you can use the Except field to specify an exception.

This criterion can be used to detect local IP addresses.

You can enter an IP address (such as "11.1.1.2/32") in the condition field, or you can select a Shared List (Network type) and specify a “matches list” condition.

Similarly, you can exclude any host you do not want to track in the Except field.

This criterion detects local IP addresses in a network connection and adds another layer of security to subnets, enabling you to enforce policies pertaining to local and external VPN connections. For example:

Registry activity rules let you detect changes to the registry. You can detect registry keys, names, values (data assigned to keys), and programs.

The Windows Registry Editor is a great tool for exploring and editing the Windows Registry. You can use it to examine registry keys and values, which is helpful for creating custom registry rules.

The screenshot below shows how to discover keys, names and values from the Registry Editor:

The table below explains what criteria the Registry Activity rules support and what conditions you can use with them.

This criterion can be used to specify the registry key(s) to detect.

You can enter any text in the condition field and choose from “contains” or “equals” conditions. Or, you can select the “matches glob” condition and use wildcards such as "*", "?", "[abc]", "[a-z]", etc. For example, "?at" will match "Cat", "cat", "Bat", or "bat".

Similarly, you can exclude any key you do not want to track in the Except field.

Note that actual registry keys differ from what they look like in the Windows Registry Editor.

For example, the “\registry\machine” key is represented as “Computer\HKEY_LOCAL_MACHINE” on the Registry Editor. Or, the “\registry\users’ is represented as “Computer\HKEY_USERS’.

Teramind will use the actual keys to match the conditions instead of what's shown on the Windows Registry. For convenience, if the string condition for the key starts with one of the following, it will be recoded for the actual search accordingly:

Use this criterion to specify the name of a registry value. For example, the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR” key may contain a value called “Start”.

You can enter any text in the condition field and choose from “contains” or “equals” conditions. Or, you can select the “matches glob” condition and use wildcards such as "*", "?", "[abc]", "[a-z]", etc. For example, "?at" will match "Cat", "cat", "Bat", or "bat".

Similarly, you can exclude any name you do not want to track in the Except field.

This criterion can be used to detect the value of a registry name. Windows registry values can contain a String, Multi-String, Binary, etc. So, enter a value accordingly.

You can enter any text in the condition field and choose from “contains” or “equals” conditions. Or, you can select the “matches glob” condition and use wildcards such as "*", "?", "[abc]", "[a-z]", etc. For example, "?at" will match "Cat", "cat", "Bat", or "bat".

Similarly, you can exclude any name you do not want to track in the Except field.

This criterion can help you identify which application or service is responsible for making the registry changes.

You can enter any text in the condition field and choose from “contains” or “equals” conditions. Or, you can select the “matches glob” condition and use wildcards such as "*", "?", "[abc]", "[a-z]", etc. For example, "?at" will match "Cat", "cat", "Bat", or "bat".

Similarly, you can exclude any name you do not want to track in the Except field.

The Camera Usage Activity rule lets you detect when a camera/webcam is used. You can detect the camera name and the application in which the camera is being used.

The table below explains what criteria the Camera Usage Activity rules support and what conditions you can use with them.

This criterion lets you detect if any camera is turned on in any application.

Use this criterion to specify the camera(s) you want to detect.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List and specify a “matches list” or “equals list” condition.

Similarly, you can exclude any applications by specifying them in the Except field.

Use this criterion to specify the applications you want to detect that might be using the camera.

You can enter some text in the condition field and choose from “contains”, “equals”, or “matches regex” conditions. Or, you can select a Shared List and specify a “matches list”, or “equals list” condition.

Similarly, you can exclude any applications by specifying them in the Except field.

Windows events are all the activities tracked by the OS. These include Applications, System, Security, Hardware, etc.

You can see a list of all Windows events on the Windows Event Viewer:

The ability to detect these events is a very powerful tool because it allows an administrator to identify issues with the computer, discover security gaps, and stop potential threats.

The Windows Log Event Activity rule allows you to detect these Windows events.

The Windows Log Event Activity rules come with only one criterion.

Use this criterion to specify one or more Windows event IDs.

You can enter numeric values in the condition field and use the “=”, “>”, “>=”, and “<” logic.

Similarly, you can use the Except field to specify an exception.