> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Alert Rules

> Reference for Syteca alert rule construction — parameters, comparison operators, logical operators, regex syntax, and worked examples for common detection patterns.

Alert rules determine **what counts as an event** that triggers an alert. Every alert must have at least one rule. This page is the complete reference for the rule engine — every parameter, every operator, every logical-combination semantic, plus worked examples.

For the surrounding alert workflow (add, edit, assign, enable, delete), see [Alerts](/docs/session-monitoring/alerts). For the rule examples that ship pre-configured with Syteca, see [Default alerts](/docs/session-monitoring/default-alerts).

## Rule structure

Each rule consists of three fields, set left to right in the **Rules** section of the Add/Edit Alert page:

| Field                              | Contains                                                                               |
| ---------------------------------- | -------------------------------------------------------------------------------------- |
| **Parameter** *(left)*             | What kind of event to detect — application opened, URL visited, command executed, etc. |
| **Comparison operator** *(middle)* | How to compare — Equals, Like, Not equals, Not like, or Matches (Regex).               |
| **Value** *(right)*                | The string to compare against.                                                         |

Combine multiple rules in one alert with the **+ Or** and **+ And** buttons. Delete a rule by clearing its value or clicking the **Close** icon on the right.

## Parameters

The parameter selection determines which Client OSes the rule applies to and what kind of data it inspects. Parameters are grouped by applicability.

### Applied to all Clients

| Parameter    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Example value |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
| **Username** | Name of the user whose activity is monitored. Triggers whenever the specified user logs into a Client. For Windows / macOS users, the format `<domain or computer>\<username>` is also accepted. If [secondary user authentication](/docs/administration/access/two-factor-authentication) is enabled and the secondary username matches, the alert triggers — *example:* rule `Username Like John`; user logs in as `Guest` then enters `John` as the secondary login; alert triggers, and the first record `(Guest (John))` is marked. | `John`        |

### Applied to Windows, macOS, and Linux (X Window System GUI only)

| Parameter       | Description                                   | Example value |
| --------------- | --------------------------------------------- | ------------- |
| **Application** | Name of the application opened on the Client. | `winword.exe` |
| **Title**       | Name appearing in a window title bar.         | `My document` |

### Applied to Windows and macOS Clients only

| Parameter                           | Description                                                                                                                                                     | Example value                                              |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| **Keystrokes (Windows/macOS)**      | Keystrokes entered by the user.                                                                                                                                 | `download`                                                 |
| **URL (Windows/macOS)**             | URL entered in the browser address bar or visited. **Requires [URL monitoring](/docs/session-monitoring/recording/user-activity-recording) enabled for the Client.** | `facebook.com`                                             |
| **Clipboard Copy (Windows/macOS)**  | Value copied or cut. Enter `*` to detect any copy/cut action.                                                                                                   | `confidential`                                             |
| **Clipboard Paste (Windows/macOS)** | Value pasted. Enter `*` to detect any paste action.                                                                                                             | `confidential`                                             |
| **File Upload (Windows/macOS)**     | Filename uploaded by the user.                                                                                                                                  | `*`, `*.exe`, `*.app`, `c:\TopSecret\*.*` *(Windows only)* |

<Tip>
  For Windows Clients, custom file-upload alerts can be built by combining multiple rules across other parameter types — for example, the [default Downloading-via-browser alert](/docs/session-monitoring/default-alerts#fraudulent-activity) uses three Application rules (for 3 browser apps) combined with a Title rule matching `Save`.
</Tip>

### Applied to Linux Clients only (SSH and X Window System sessions)

| Parameter             | Description                                                                                                                                                                                                                             | Example value       |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
| **Command (Linux)**   | Command entered in the Linux terminal.                                                                                                                                                                                                  | `sudo`              |
| **Parameter (Linux)** | Parameter entered alongside a Linux command.                                                                                                                                                                                            | `ImportantDocument` |
| **Input (Linux)**     | Text entered by the user in the Linux terminal — the full input, not just a command or parameter. Enter text, symbols, and numbers; separate multiple inputs with a semicolon (`;`) to trigger the alert if any one of them is entered. | `cd /etc/.ekran/`   |

<Note>
  **Input (Linux)** triggers on the full input entered by the user — in both SSH and local terminal sessions, in any shell (`bash`, `ksh`, and so on), including inputs completed using Tab. It requires the **Enable user input monitoring** option to be enabled on the Client.
</Note>

### Applied to Active Directory groups

| Parameter                              | Description                                                                                                                                                                    | Example value | OS              |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | --------------- |
| **User Belonging to Domain Group**     | Name of an AD domain group. The **comparison operator** is the AD domain name (not Equals/Like/etc.). Triggers when a user from the specified domain group logs into a Client. | `Marketing`   | Windows / macOS |
| **Computer Belonging to Domain Group** | Name of an AD domain group. Triggers when a Client computer belonging to this domain group is logged into. **Comparison operator is the AD domain name.**                      | `Accounting`  | Windows         |

<Warning>
  Alerts using **Computer Belonging to Domain Group** must be assigned to the **All Clients** group to function correctly.
</Warning>

## Comparison operators

For all parameters **except** Active Directory group parameters, these comparison operators are available:

| Operator       | Description                | Value | Matches              | Doesn't match               |
| -------------- | -------------------------- | ----- | -------------------- | --------------------------- |
| **Equals**     | Exact match                | `Jon` | `Jon`                | `Jonnie`                    |
| **Like**       | Contains the value         | `Jon` | `Jonnie`, `Jonathan` | `Johan`                     |
| **Not equals** | Not an exact match         | `Jon` | `Oliver`, `Jonnie`   | `Jon`                       |
| **Not like**   | Does not contain the value | `Jon` | `Oliver`, `Johan`    | `Jon`, `Jonnie`, `Jonathan` |

The **Matches (Regex)** operator is also available for most parameters — see [Regex rules](#regex-rules) below.

## Logical operators and multiple rules

When multiple rules combine in one alert, the combination semantics depend on whether the rules use the *same* or *different* parameter types.

| Combination                                                                   | Logic       | Behavior                                                            |
| ----------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------- |
| Multiple rules with the **same parameter** + **OR** + Like/Equals             | OR          | Trigger if any one rule's condition matches.                        |
| Multiple rules with **different parameters** + **AND** + Like/Equals          | AND         | Trigger only if all rules' conditions match.                        |
| Same parameter with **OR** + a different parameter with **AND** + Like/Equals | OR-then-AND | Trigger if any of the OR rules match AND the AND rule also matches. |
| Multiple rules with the **same parameter** + **AND** + Not equals/Not like    | AND         | Trigger if all rules' conditions match.                             |

### Example combinations

<Tabs>
  <Tab title="Linux OR Windows trigger">
    | Rule   | Parameter | Operator | Value          |
    | ------ | --------- | -------- | -------------- |
    | Rule 1 | Command   | Equals   | `su`           |
    | *(OR)* |           |          |                |
    | Rule 2 | URL       | Like     | `facebook.com` |

    **Triggers** when a user enters `su` in Linux terminal **OR** visits `facebook.com` on Windows.
  </Tab>

  <Tab title="Either Excel or Word (same parameter, OR)">
    | Rule   | Parameter   | Operator | Value         |
    | ------ | ----------- | -------- | ------------- |
    | Rule 1 | Application | Equals   | `excel.exe`   |
    | *(OR)* |             |          |               |
    | Rule 2 | Application | Equals   | `winword.exe` |

    **Triggers** when any user opens Excel **OR** Word.
  </Tab>

  <Tab title="Nancy + Word (different parameters, AND)">
    | Rule    | Parameter   | Operator | Value         |
    | ------- | ----------- | -------- | ------------- |
    | Rule 1  | Application | Equals   | `winword.exe` |
    | *(AND)* |             |          |               |
    | Rule 2  | Username    | Like     | `Nancy`       |

    **Triggers** when Nancy specifically opens Word.
  </Tab>

  <Tab title="Nancy + (Excel OR Word) (OR + AND)">
    | Rule    | Parameter   | Operator | Value         |
    | ------- | ----------- | -------- | ------------- |
    | Rule 1  | Application | Equals   | `excel.exe`   |
    | *(OR)*  |             |          |               |
    | Rule 2  | Application | Equals   | `winword.exe` |
    | *(AND)* |             |          |               |
    | Rule 3  | Username    | Equals   | `Nancy`       |

    **Triggers** when Nancy opens Excel **OR** Word.
  </Tab>

  <Tab title="Anything except Excel or Word (NOT + AND)">
    | Rule    | Parameter   | Operator   | Value         |
    | ------- | ----------- | ---------- | ------------- |
    | Rule 1  | Application | Not equals | `excel.exe`   |
    | *(AND)* |             |            |               |
    | Rule 2  | Application | Not equals | `winword.exe` |

    **Triggers** when any user opens any application that isn't Excel and isn't Word.
  </Tab>
</Tabs>

## Worked rule examples

Common detection patterns with the exact rule configuration:

<Steps>
  <Step title="Any user opening Facebook">
    | Parameter | Operator | Value          |
    | --------- | -------- | -------------- |
    | URL       | Like     | `facebook.com` |

    Requires [URL monitoring](/docs/session-monitoring/recording/user-activity-recording) enabled on the Client.
  </Step>

  <Step title="Any user visiting any website except Facebook">
    | Parameter | Operator | Value          |
    | --------- | -------- | -------------- |
    | URL       | Not like | `facebook.com` |
  </Step>

  <Step title="Specific user (Stefan) opening Facebook">
    | Parameter | Operator | Value          |
    | --------- | -------- | -------------- |
    | URL       | Like     | `facebook.com` |
    | *(AND)*   |          |                |
    | Username  | Like     | `Stefan`       |

    To match multiple users (any one of Stefan or Rick), add an OR rule with `Username Like Rick`. To match anyone *except* Stefan, change to `Username Not like Stefan`.
  </Step>

  <Step title="Any user opening MS Word">
    | Parameter   | Operator | Value         |
    | ----------- | -------- | ------------- |
    | Application | Equals   | `winword.exe` |

    To match any application *except* Word, change to `Application Not equals winword.exe`.
  </Step>

  <Step title="Specific user (Stefan) opening Facebook in Chrome specifically">
    | Parameter   | Operator | Value          |
    | ----------- | -------- | -------------- |
    | URL         | Like     | `facebook.com` |
    | *(AND)*     |          |                |
    | Application | Equals   | `chrome.exe`   |
    | *(AND)*     |          |                |
    | Username    | Like     | `Stefan`       |
  </Step>

  <Step title="USB storage devices plugged in">
    | Parameter | Operator | Value        |
    | --------- | -------- | ------------ |
    | Title     | Like     | `USBStorage` |
  </Step>

  <Step title="Any user entering sudo or su in Linux">
    | Parameter       | Operator | Value  |
    | --------------- | -------- | ------ |
    | Command (Linux) | Equals   | `sudo` |
    | *(OR)*          |          |        |
    | Command (Linux) | Equals   | `su`   |
  </Step>

  <Step title="A specific command-and-input combination in Linux">
    | Parameter         | Operator | Value            |
    | ----------------- | -------- | ---------------- |
    | Parameter (Linux) | Like     | `-f`             |
    | *(AND)*           |          |                  |
    | Input (Linux)     | Like     | `./uninstall.sh` |

    Triggers when a user enters a command containing both the `-f` parameter and the input `./uninstall.sh` — for example, `/opt/.Ekran/uninstall.sh -f`.
  </Step>

  <Step title="A Linux input matching a regex pattern">
    | Parameter     | Operator        | Value            |
    | ------------- | --------------- | ---------------- |
    | Input (Linux) | Matches (Regex) | `cd .*/\.ekran/` |

    Triggers when a user enters an input matching the regular expression — for example, `cd /etc/.ekran`.
  </Step>

  <Step title="Any user in a specific AD domain group accessing any Client">
    | Parameter                      | Operator           | Value          |
    | ------------------------------ | ------------------ | -------------- |
    | User Belonging to Domain Group | *(AD domain name)* | *(group name)* |

    The comparison operator slot holds the AD domain name (not Equals/Like).
  </Step>

  <Step title="Anyone opening Facebook from any computer in a specific AD domain group">
    | Parameter                          | Operator           | Value          |
    | ---------------------------------- | ------------------ | -------------- |
    | URL                                | Like               | `facebook.com` |
    | *(AND)*                            |                    |                |
    | Computer Belonging to Domain Group | *(AD domain name)* | *(group name)* |

    **Computer Belonging to Domain Group** alerts must be assigned to the **All Clients** group.
  </Step>

  <Step title="A user in one AD group opening MS Word on a computer in another AD group">
    | Parameter                          | Operator           | Value              |
    | ---------------------------------- | ------------------ | ------------------ |
    | Application                        | Equals             | `winword.exe`      |
    | *(AND)*                            |                    |                    |
    | User Belonging to Domain Group     | *(AD domain name)* | *(user group)*     |
    | *(AND)*                            |                    |                    |
    | Computer Belonging to Domain Group | *(AD domain name)* | *(computer group)* |

    Both AD parameters use the AD domain name as the comparison operator. The alert must be assigned to **All Clients**.
  </Step>
</Steps>

## Regex rules

The **Matches (Regex)** comparison operator lets you define rule values as **regular expressions using ECMAScript grammar**. Currently supported on Windows and Linux Clients.

### Parameters that support regex

* Application
* Title
* Username
* Keystrokes (Windows/macOS)
* URL (Windows/macOS)
* Clipboard Copy (Windows/macOS)
* Clipboard Paste (Windows/macOS)
* File Upload (Windows/macOS)
* Command (Linux)
* Parameter (Linux)
* Input (Linux)

<Warning>
  Regex is **not supported** with the **User Belonging to Domain Group** and **Computer Belonging to Domain Group** parameters.
</Warning>

### Define a regex rule

<Steps>
  <Step title="Open Add or Edit Alert">
    On the **Alerts** page, click **Add** to add a new alert, or click an existing alert to open it.
  </Step>

  <Step title="Pick a regex-supported parameter">
    In the **Rules** section, select one of the [regex-supported parameters](#parameters-that-support-regex) in the left field.
  </Step>

  <Step title="Select Matches (Regex)">
    In the middle (operator) field, select **Matches (Regex)**.
  </Step>

  <Step title="Enter the regex value">
    In the right (value) field, enter your regular expression using ECMAScript grammar. For example, `^(chrome|firefox|edge|opera)\.exe$` matches any of four browser executables.
  </Step>

  <Step title="Combine with other rules (optional)">
    Click **+ Or** or **+ And** to add additional rules with OR / AND logic.
  </Step>

  <Step title="Save">
    After valid values are entered into all required fields, click **Finish** at the bottom of the page.
  </Step>
</Steps>

<Warning>
  Processing speed can be affected if regular expressions are very abstract or complex — particularly patterns using `*` with many permutations. Test rules against representative data before deploying widely.
</Warning>

### Regex example: browser + paste of email or phone number

A rule combination that detects when a user pastes an email address or phone number into a browser — useful for outbound-email-composition monitoring or pre-exfiltration detection:

| Parameter                       | Operator        | Value                                   |         |      |                |
| ------------------------------- | --------------- | --------------------------------------- | ------- | ---- | -------------- |
| Application                     | Matches (Regex) | \`^(chrome                              | firefox | edge | opera).exe\$\` |
| *(AND)*                         |                 |                                         |         |      |                |
| Clipboard Paste (Windows/macOS) | Matches (Regex) | `[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}` |         |      |                |
| *(OR)*                          |                 |                                         |         |      |                |
| Clipboard Paste (Windows/macOS) | Matches (Regex) | `\+?\d[\d\s\-()]{7,}\d`                 |         |      |                |

Triggers when one of the four browsers is open AND the user pastes either an email address OR a phone number pattern.

## Related

<CardGroup cols={2}>
  <Card title="Alerts" icon="bell" href="/docs/session-monitoring/alerts">
    The day-to-day alert workflow: add, edit, assign, delete, import/export.
  </Card>

  <Card title="Default alerts catalog" icon="book-marked" href="/docs/session-monitoring/default-alerts">
    Preconfigured alerts that ship with Syteca, illustrating the patterns above.
  </Card>

  <Card title="Block on alert" icon="ban" href="/docs/session-monitoring/block-on-alert">
    Automatically block users when an alert triggers.
  </Card>

  <Card title="Sensitive Data Masking" icon="shield-off" href="/docs/session-monitoring/masking/sensitive-data">
    Mask sensitive data at recording time — uses a similar regex approach.
  </Card>
</CardGroup>