There are three ways you can investigate rule violation incidents on Teramind.
Using the Behavioral Alerts Dashboard
This is your primary source to view all rule violation incidents. You can use the Behavior Alerts dashboard to view a list of rule violation incidents with all the necessary details, such as the date/time the incident happened, the user or activity involved, and other pertinent information. You can also view a session recording of an alert, export the alerts report, or schedule it for auto delivery to selected email addresses.
You can access the Behavior Alerts dashboard from the Dashboards > All Dashboards menu:
Click the Movie Camera
icon to view the session recording of the incident (see the Using the Session Player section below).Click the Three Dots
icon in front of a row to access it’s Context Menu. From the menu, you can use options to view details of the event, access the Session Player, or investigate the user (view their detailed activity report).
For more information on the Behavior Alerts dashboard and to learn how to use its different features, check out the Dashboards > Behavior Alerts section in the User Guide.
Using the Session Player
Session Player allows you to view a user’s desktop in live view or history playback mode. You can precisely locate when a rule violation incident occurred, check out all the alert notifications the user received, and investigate the trail of user activities leading up to the incident. If the user is online, you can take remote control of their computer or freeze their inputs to prevent further incidents.
If Audio recording is enabled, you can also hear recordings of both sound outputs and inputs (speakers/line-out, microphone/line-in). Finally, you can take snapshots of the user’s desktop, forward the recordings to select email addresses, or download them as MP4 files.
Click the Bell
icon at the top-right corner of the player to open the Log of events panel. From there, you can view rule violation incidents by clicking the Notifications tab.Click an event to jump to that location in the video. You can also click on a Notification
icon on the video player’s timeline to jump to the exact moment the incident occurred. Note: the number inside the icon represents the number of times the rule was violated during the selected period.You can use the Tags feature to add labels and notes to an incident to facilitate auditing and investigation.
Click the Download
button to download/export the video as an MP4 file to be used as evidence.
For more information on the Session Player and to learn how to use its different features, check out the Session Player section in the User Guide.
Using the Notify and Snapshot Emails
The Notify action sends an email when the rule is violated. You can access the session recording, edit the rule, etc., from the email’s links.
The Daily Snapshot/Email Digest is another source of information for you to view the summary of all users’ activities, including what rules were violated. The snapshot is delivered daily to administrators, but you can also configure the Alerts settings to send it to department managers.