Skip to main content
Alert rules determine what counts as an event that triggers an alert. Every alert must have at least one rule. This page is the complete reference for the rule engine — every parameter, every operator, every logical-combination semantic, plus worked examples. For the surrounding alert workflow (add, edit, assign, enable, delete), see Alerts. For the rule examples that ship pre-configured with Syteca, see Default alerts.

​
Rule structure

Each rule consists of three fields, set left to right in the Rules section of the Add/Edit Alert page: Combine multiple rules in one alert with the + Or and + And buttons. Delete a rule by clearing its value or clicking the Close icon on the right.

​
Parameters

The parameter selection determines which Client OSes the rule applies to and what kind of data it inspects. Parameters are grouped by applicability.

​
Applied to all Clients

​
Applied to Windows, macOS, and Linux (X Window System GUI only)

​
Applied to Windows and macOS Clients only

For Windows Clients, custom file-upload alerts can be built by combining multiple rules across other parameter types — for example, the default Downloading-via-browser alert uses three Application rules (for 3 browser apps) combined with a Title rule matching Save.

​
Applied to Linux Clients only (SSH and X Window System sessions)

Input (Linux) triggers on the full input entered by the user — in both SSH and local terminal sessions, in any shell (bash, ksh, and so on), including inputs completed using Tab. It requires the Enable user input monitoring option to be enabled on the Client.

​
Applied to Active Directory groups

Alerts using Computer Belonging to Domain Group must be assigned to the All Clients group to function correctly.

​
Comparison operators

For all parameters except Active Directory group parameters, these comparison operators are available: The Matches (Regex) operator is also available for most parameters — see Regex rules below.

​
Logical operators and multiple rules

When multiple rules combine in one alert, the combination semantics depend on whether the rules use the same or different parameter types.

​
Example combinations

Triggers when a user enters su in Linux terminal OR visits facebook.com on Windows.

​
Worked rule examples

Common detection patterns with the exact rule configuration:
1

Any user opening Facebook

Requires URL monitoring enabled on the Client.
2

Any user visiting any website except Facebook

3

Specific user (Stefan) opening Facebook

To match multiple users (any one of Stefan or Rick), add an OR rule with Username Like Rick. To match anyone except Stefan, change to Username Not like Stefan.
4

Any user opening MS Word

To match any application except Word, change to Application Not equals winword.exe.
5

Specific user (Stefan) opening Facebook in Chrome specifically

6

USB storage devices plugged in

7

Any user entering sudo or su in Linux

8

A specific command-and-input combination in Linux

Triggers when a user enters a command containing both the -f parameter and the input ./uninstall.sh — for example, /opt/.Ekran/uninstall.sh -f.
9

A Linux input matching a regex pattern

Triggers when a user enters an input matching the regular expression — for example, cd /etc/.ekran.
10

Any user in a specific AD domain group accessing any Client

The comparison operator slot holds the AD domain name (not Equals/Like).
11

Anyone opening Facebook from any computer in a specific AD domain group

Computer Belonging to Domain Group alerts must be assigned to the All Clients group.
12

A user in one AD group opening MS Word on a computer in another AD group

Both AD parameters use the AD domain name as the comparison operator. The alert must be assigned to All Clients.

​
Regex rules

The Matches (Regex) comparison operator lets you define rule values as regular expressions using ECMAScript grammar. Currently supported on Windows and Linux Clients.

​
Parameters that support regex

  • Application
  • Title
  • Username
  • Keystrokes (Windows/macOS)
  • URL (Windows/macOS)
  • Clipboard Copy (Windows/macOS)
  • Clipboard Paste (Windows/macOS)
  • File Upload (Windows/macOS)
  • Command (Linux)
  • Parameter (Linux)
  • Input (Linux)
Regex is not supported with the User Belonging to Domain Group and Computer Belonging to Domain Group parameters.

​
Define a regex rule

1

Open Add or Edit Alert

On the Alerts page, click Add to add a new alert, or click an existing alert to open it.
2

Pick a regex-supported parameter

In the Rules section, select one of the regex-supported parameters in the left field.
3

Select Matches (Regex)

In the middle (operator) field, select Matches (Regex).
4

Enter the regex value

In the right (value) field, enter your regular expression using ECMAScript grammar. For example, ^(chrome|firefox|edge|opera)\.exe$ matches any of four browser executables.
5

Combine with other rules (optional)

Click + Or or + And to add additional rules with OR / AND logic.
6

Save

After valid values are entered into all required fields, click Finish at the bottom of the page.
Processing speed can be affected if regular expressions are very abstract or complex — particularly patterns using * with many permutations. Test rules against representative data before deploying widely.

​
Regex example: browser + paste of email or phone number

A rule combination that detects when a user pastes an email address or phone number into a browser — useful for outbound-email-composition monitoring or pre-exfiltration detection: Triggers when one of the four browsers is open AND the user pastes either an email address OR a phone number pattern.

Alerts

The day-to-day alert workflow: add, edit, assign, delete, import/export.

Default alerts catalog

Preconfigured alerts that ship with Syteca, illustrating the patterns above.

Block on alert

Automatically block users when an alert triggers.

Sensitive Data Masking

Mask sensitive data at recording time — uses a similar regex approach.