Introduction
Behavior Rules are the central component of Teramind's platform, driving its capabilities in insider threat detection, data loss prevention, compliance, and productivity optimization.
This guide walks you through the steps required to build, configure, and activate a new Behavior Rule from start to finish. As a running example, we will create an Activity rule that detects when users in the Marketing department spend 10 minutes or more on Facebook, shows them a warning, and notifies a manager after repeated violations.
Step 1: Access the Rule Editor
1. From the main menu, navigate to Configurations > Behavior Policies.
2. Click the New Rule button. This will open the Rule Editor where you will configure your rule in the subsequent tabs.
Step 2: General Settings: Configure the rule's basic details
3. Enter a Rule Name (e.g., Facebook Visits).
4. Optionally, provide a Rule Description (e.g., Detect visits to facebook.com).
5. Select the Parent Policy the rule will belong to (e.g., Unproductive Behavior Rules).
6. Select a Rule Type from the drop-down menu. There are three types of rules you can select from:
Activity: With this type of rule, you can detect user and application activities such as visiting a website, uploading a file, etc.
Content Sharing: These rules are used to detect content or text inside a monitored object. For example, detect uploading a file when it contains credit card numbers.
Schedule: This rules are used to detect employee schedule discrepancies such as when an employee is late, logged in odd hours, etc.
In our example, we selected the Activity rule type.
7. Optionally, select or enter Tags. Tags are keywords you can assign to a rule to easily identify it.
8. Once you select a Rule Type, you can then turn on one or more channels under Select the type of activities (for the Activity rule type) or Select the type of contents (for the Content Sharing rule type). These are the monitoring channels the rule will detect.
In our example, we selected the Webpages activity type.
9. Optionally, you can set a Rule violation severity to specify a risk level for the rule. You can either drag the slider or use the number field to enter the severity.
10. Optionally, you can change the rule schedule under the Time when rule is active section by dragging the two circles on the slider. Then, click the Continue button.
Check out the Understanding Common Rule Elements section of the Rules Guide to learn more about General Settings.
Step 3: Employees: Assign rule targets
The Employees tab allows you to specify which targets (employees, departments, computers, etc.) the rule will apply to.
11. By default, the rule will inherit the rule targets from its parent policy. However, you can turn off the Inherit targets from Parent Policy option to select them manually.
12. Select employees, computers, and/or departments from the Assign to field (e.g., the Marketing department).
13. Optionally, you can exclude any targets you don’t want to be included using the Exclude from rule field. For example, if you included a department in the Assign to field but want to exclude a few employees from the department, you can exclude them in the Exclude from rule field (e.g., Anna Wintour). Then, click the Continue button.
Step 4: Webpages: Define detection criteria and conditions
This tab is dynamic and changes based on the monitoring channel selected in Step 6. This is where you define the specific conditions that must be met for the rule to trigger. In this case, since we selected the Webpages activity, we can set criteria and conditions to detect various web browsing activities.
14. You will see a default Condition 1 condition block already added. Click the Add button to add a rule criterion to this condition block. Rule criteria let you define detection parameters for the rule.
15. Select the Webpage Url criterion and enter a URL or part of a URL you want to detect (e.g., facebook.com). Then, select a match condition from the list (e.g., Contains facebook.com). Note that you can also use a Shared List, a regular expression and other conditions with the criteria.
16. Click the Add button again and select the Request type criterion. Then, select is Webpage visited to detect only actual page visits rather than every resource the page requests. The Request type criterion becomes available only after you add a Webpage Url or Query argument name criterion.
17. Click the Add button again and select the Time Active (min) criterion. Then, select an operator (e.g., >=) and enter the number of minutes (e.g., 10). In our example, the rule will trigger when a user is active on facebook.com for 10 minutes or more.
Note: All criteria within a condition block must be met for the condition to match. You can click the New condition button to add another condition block. When a rule has multiple condition blocks, it triggers when any of them is met.
Check out the Understanding Common Rule Elements section of the Rules Guide to learn more about rule conditions, criteria, rule logic, etc.
Check out the Webpages rule section of the Rules Guide to learn more about criteria supported by this rule type.
Step 5: Actions: Set up what actions to take on rule violation
The Actions tab is where you define the system's response to a rule violation.
Basic
The Basic mode is the easiest way to configure actions and is recommended for beginners.
18. Select one or more actions according to your need. For example, turn on the Warn action to show the user a warning message (e.g., Facebook is not allowed during work hours.), or turn on the Notify action to notify one or more users about the rule violation. Note that some actions cannot be combined (e.g., Lock out user and Block cannot be combined with Warn).
Advanced
In Advanced mode, you can set up risk thresholds and severity levels for the rule and trigger different actions based on how often a rule is violated. Any actions you set up in the Basic mode appear as the first threshold.
19. From the Choose time period for threshold list, select the desired time period for your thresholds (e.g., Daily).
20. In the Choose maximum numbers of saved alerts per day field, enter the maximum number of alerts that can be triggered for this rule in a single day.
21. Click the New threshold button to add a new threshold. For each threshold you add, you can set the following:
Enter a number in the After ... violation(s) field to define how many times the rule can be violated before the actions are triggered (e.g., 3).
Select a risk severity from the Define risk level drop-down list. Your options are None, Low, Moderate, High, or Critical.
22. Turn on one or more actions for the threshold. These actions (e.g., Notify, Warn) are the same as those available in the Basic mode. In our example, we turned on Notify and selected Anatoly Krause from the Add an employee list. You can also type an email address and click Add.
Check out the Defining Rule Actions section of the Rules Guide to learn more about rule actions.
Step 6: Save and activate the rule
23. Click the Submit Rule button to save and activate the rule. A Behavior rule saved successfully message will appear, and the new rule (e.g., Facebook Visits) will be listed under its parent policy.