Introduction
Teramind's OCR (Optical Character Recognition) rules help you detect sensitive text on screen.
Rule Walkthrough
The example below demonstrates how you can use an OCR rule with advanced detection features like Regular Expressions to detect dynamic content and patterns such as credit card numbers.
Setting Up the Rule
General Settings
1. Navigate to Configurations > Behavior Policies and click the New Rule button.
2. Enter a Rule Name (e.g., Credit Card Numbers on Screen). Optionally, enter a Rule Description (e.g., Detect credit card numbers displayed on screen).
3. Select a Parent Policy (e.g., Insider Risk) and keep Activity selected for Rule Type.
4. Turn on OCR under Select the type of activities. Then, click the Continue button.
Helpful Resources:
Employees
5. Keep the Inherit targets from Parent Policy option turned on to use the policy’s default targets.
6. Alternatively, turn it off and manually select the employees, departments and/or computers for the rule's targets from the Assign to field.
7. Optionally, you can exclude targets in the Exclude from rule field. Then, click the Continue button.
Helpful Resources:
OCR
8. A default condition block, Condition 1, is already added to the rule. Click the + Add button and select the On-screen text criterion. Configure the condition as follows:
Condition 1
9. In the On-screen text field, enter:
[0-9]{4}\s*-?\s*[0-9]{4}\s*-?\s*[0-9]{4}\s*-?\s*[0-9]{4}Then, select Regular expression match from the list that appears and click the Continue button.
Helpful Resources:
Actions
10. Turn on the Notify action.
11. Select the users you want to notify when the rule is violated from the Add an employee list (e.g., Anatoly Krause), or type an email address and click Add.
12. Click the Submit Rule button to save and activate the rule. A Behavior rule saved successfully message will appear, and the new rule will be listed under its parent policy.
The time when the OCR rule will trigger depends on how quickly your instance can process the screen recording data (session mining).
You can find your instance's Session mining delay status on the Configurations > Settings > OCR screen.
Helpful Resources:
Rationale for the Rule
This rule uses Teramind's patented OCR engine to scan the entire screen for sensitive data, which is crucial for capturing information in images, RDP sessions, or un-parsable apps where detecting content might be difficult using other methods.
Its effectiveness relies on using a Regular expression match condition which defines the exact pattern of sensitive data to detect 16-digit credit card numbers in several formats, such as: "1234567890123456", "1234-5678-9012-3456", or "1234 5678 9012 3456".
The Notify action ensures the administrator receives an email notification when the pattern appears on a user's screen.