Introduction to the Insights Dashboard
Beta Preview Notice
Please note that Insights is currently a beta feature. Many functionalities are not yet implemented and may not work as expected. We strongly advise against using this feature in a production environment at this time.
The Insights dashboard is a specialized oversight and investigation hub. This dashboard leverages advanced algorithm to analyze raw data and detect patterns like activity falsification, while also integrating behavior alerts into a unified, real-time "newsfeed". This intuitive interface transforms complex monitoring into a streamlined workflow, serving as a centralized hub for forensic audit and simplified incident management.
1. Date Filter | |
3. Investigate | |
3. Show/Hide Video Previews | 4. Dismiss |
4. Filters | 5. Comments |
|
Sort By
The Sort by filter allows you to sort the feeds in different ways:
Recommended: This is suggested by an algorithm based on the recency, severity, duration, and other factors.
Highest Priority: Highest risky events on top.
Newest First: Newer events on top. This is the default sort mode.
Oldest First: Older events on top.
Filters
In addition to the Date and Sort By preset filters, click the Filter button to open the Filter panel, where you can apply additional filters to refine your feeds:
Source | There are two options available under this filter:
|
Category | This filter allows you to select the insight categories based on the selected Source. For example, if you select “Insights” as the Source of the incident, you will be able to see “Activity Falsification” (see notes below). However, if you choose “Behavior Rule Alerts” as the Source, you will see all associated behavior policies. |
Type | This filter allows you to select specific insight types based on the selected Insight Category. For example, if you select “Activity Falsification” as the Insight Category, you will see options such as “Key Pressing” and “Inorganic Mouse Movement”. If the Insight Category is a behavior policy, you will see all the specific behavior rules contained within that policy. |
Severity | You can apply this filter to only show feeds that have certain risk levels such as Critical, High Risk, etc. The severity/risk level is derived from the Rule violation severity field of the rules’ General Settings tab. |
Employee | This filter allows you to select one or more employees to filter the feeds. |
Activity Falsification
Activity falsification refers to incidents where users attempt to simulate activity to commit time theft. Teramind’s analysis engine can detect these potential frauds. These incidents are categorized under the "Insights" source and further divided into specific types:
Key Pressing: This is a specific insight type used to identify instances where the keyboard is being used to falsify activity. It is detected by analyzing raw data to find patterns or anomalies that suggest the input is not genuine manual work.
Inorganic Mouse Movement: This insight type identifies artificial or automated mouse movements. The system can distinguish these "inorganic" patterns from natural human interaction to detect potential fraud or time theft.
Insights Total
On the top-left corner of Insights screen, you will see a horizonal bar graph displaying the total number of incidents for a chosen period, broken down by risk severity. The risk severities are pulled directly from the Rule violation severity field of the rules’ General Settings tab.
Insight Feeds
The main feed area shows a scrollable list of insights with accompanying video recordings.
1. The top portion of a feed displays information about the incident:
Basic Information: Such as employee, department, date/time, etc.
Behavior Alert Sources: Explicitly lists the associated Rule (e.g., “Resignation Intent via AI Tools”), Policy (e.g., “Unproductive Behavior Rules”), and the alert trigger.
Insights Sources: Displays the specific Insight Category (e.g., “Activity Falsification”), Insight Type (e.g., “Key Pressing” or “Inorganic Mouse Movement”) as well as a short description of the insight.
Grouped Feeds: Similar events or incidents are grouped together. If a feed is grouped, a grouped event badge appears (e.g., “1 groped event”) next to the feed type. Video playback for a grouped feed is usually longer than that of an individual insight or alert feed.
2. You can control video playback (play, pause, rewind, fast-forward, etc.) simply by hovering over the clip. Clicking the video or the Maximize 
icon launches the Session Player in a separate window.
3. Clicking the Investigate button opens the investigation panel where you can view more details about the incident, mute or dismiss the feed, comment, etc. See the Investigate section to learn more.
4. Clicking the Dismiss button will hide the feed from the feed list. You can also dismiss a feed from the Investigate panel.
5. The Comments link shows how many comments are added to the feed. Clicking the link will open the investigation panel’s Comments tab where you can view existing comments and add new ones.
Investigate
When you click the Investigate button from the feed list, it will open the investigation panel for an incident. The panel consists of several buttons and tabs:
Mute/Unmute
The Mute/Unmute button will toggle an entire insight Type (see the Filters section above). You can mute the insight/alert type in three ways:
Mute this employee: You won’t see this type of insight for this employee in your feed anymore
Mute company-wide: No one in the organization will see this type of insight in their feeds anymore.
Mute me only: You won’t see this type of insight in your own feed anymore.
To unmute, select the corresponding Unmute option.
Dismiss
The Dismiss button works like an ignore button and applies to a single insight/alert. It’s a quick way to ignore false positives. When you dismiss a feed, you will see a pop-up feedback window. This feedback will help Teramind understand what type of insights/alerts are effective or not, if it’s a false positive, etc., and tune the engine for better detection in the future.
Video
The Video tab shows a a preview of the incident recording. You can control video playback (play, pause, rewind, fast-forward, etc.) simply by hovering over the clip. Clicking the video or the Maximize icon launches the Session Player in a separate window.
Details
The Details tab provides the "why and how" behind the insight. Depending on the insight type, it shows two types of details:
Details for Activity Falsification
For Activity Falsification insights, the Details tab shows a description for inorganic mouse movement or keypressing, which are the two types of activity falsification anomalies currently supported.
Derails for Behavior Alerts
For Behavior Alerts type insights, the Details tab shows what activity/content was detected, the detection mechanism, its risk classification, and whether it was escalated to IMS. It's essentially the raw evidence and metadata that backs the alert shown in the header. Here’s an explanation of each field shown on this tab:
Type | Detection method. For Behavior Rules, the Type field displays keywords related to the relevant rule, such as application, webpage, email, file upload, text mined OCR, keystrokes, etc. |
Send to ims | Indicates whether this insight was forwarded to the Insight Management System (IMS) or Insights dashboard. This status should always show "Yes." You can control whether a rule violation alert is sent to the Insights dashboard by enabling the Display in the Insights Feed option from the rule's General Settings tab. |
Task id | Associated task identifier (0 = no specific task linked). |
Risk | The numeric risk score for the event, ranging from 0 (no risk) to 1 (low risk). You can define this risk level using the Define risk level field on a rule's Actions > Advanced tab. |
Action | Internal action code(s) representing the type of activity captured. 1 = Block, 4 = Notify, 7 = Warn, etc. |
Tag | Shows the rule tag applied to this insight. You can assign tags to a rule from the rule’s General Settings tab. |
Comments
The Comments tab displays comments made by you and other users (provided your access control policy permits viewing them). You can also add comments to an incident to assist with an investigation. To add a new comment, enter your text and click Write comment.
Related
Shows related insights and incidents across all employees for the same insight type, rather than an individual employee's history.
History
Shows the activity history related to the insight. For example, comments, mute/unmute, dismiss, etc.