Alerts

Spector Client (Client) is configured to record Keyword events by selecting options within the Alerts configuration tab.  The Alerts configuration tab can be found when:

• Pre-configuring a Client installation file using the Spector CNE Deployment Utility

Figure 1: Alert Settings within Deployment Utility

• Selecting a computer within the Configure Computers view of the Control Center and then right click for Client Settings

Figure 2: Alert Settings within Configure Computers view

• Selecting the Settings button within the Spector Viewer when viewing the recordings of a computer from the Monitor Computers View of the Control Center

Figure 3: Alerts Settings within Viewer

• Selecting the Settings button within the Spector Viewer, if the Viewer was installed as part of the Client installation (this is only recommended for troubleshooting)

The Client has powerful capabilities to monitor the activity of a computer's user and detect keywords that occur within other recorded events. A Keyword event occurs when a pre-defined word or phrase is found in a Web site, Email, Keystroke, or Chat/IM event. When the keyword is detected, the Client can immediately send a message to warn you of the event. The Client can increase the rate of Snapshot recording in order to be certain that all details of the activity on the computer are recorded.

Keywords

Create the list of keywords that the Client should use for scanning recorded events. The keyword can include any character, including spaces.

Note: When the keyword list is modified for a computer that is already running the Client, the new keyword list will not take effect until the current user on the computer logs off and a subsequent log on takes place. The previous keyword list will continue to remain in effect until the user logs off.

Figure 4: Keyword Add Dialog

• New  Select the New button to add a keyword or phrase into the keyword list

• Select the Match whole word only option if you want the keyword you entered to ONLY match if that keyword is encountered by itself and NOT part of another word

Note: The keyword must be surrounded by non-alphanumeric characters. For example, if the keyword is “sex” and the Match whole word only option is selected, then the Client will not detect a keyword match for the word “Essex”, even though it contains the spelling for the word “sex”. If the keyword is “sex” and the Match whole word only option is selected, then the Client will detect a keyword match for the URL www.sex.com because the word “sex” is framed by non-alphanumeric characters. Enable this option to avoid receiving many unnecessary alerts for keywords contained within other words

Note: When importing or adding keywords, duplicate keywords are not removed.

• Delete  Select the keyword or keywords to delete from the list. Remove them by clicking on the Delete button

• Export  The Export button allows all keywords in the list to be exported to a text file that can then be imported to another Client setting configuration  

• When keywords are exported into the file, each line of the file contains the keyword followed by a space and then the numbers 1 or 0

• Number 1 signifies that Match whole word only is enabled for that keyword

• Number 0 signifies that Match whole word only is NOT enabled for that keyword

• Import  A text file containing keywords can be imported to add keywords to the keyword list. The Import function expects one keyword to be on each line and as an option, each keyword followed by a space and then number “1” or number “0”

• Number “1” signifies that Match whole word only is enabled for that keyword

• Number “0” signifies that Match whole word only is NOT enabled for that keyword

• If the line does not end in a space and number “1” or a space and number “0”, the Client will assume that Match whole word only is to be enabled and the entire line is the keyword

Examples:

Note: Any line beginning with the “#” character is considered to be a comment and will be ignored when importing keywords.

Keyword Alert Action

When a keyword is detected within other recorded events, a Keyword event is recorded. The Client can take the following actions when the Keyword event is recorded:

• Send an email notification alerting that the Keyword event has occurred

• Increase the Snapshot recording frequency in order to record more information about the activities of the computer’s user

Capture Snapshots on Alert  If this box is selected, the Client will capture Snapshots for the configured frequency and duration. This can be useful to ensure that details of what was happening on the computer are recorded by increasing the Snapshot frequency to be greater than what is configured in the Snapshot settings.

Note:  If Snapshot recording is disabled, selecting Capture Snapshots on Alert will still capture Snapshots only for the specified period. This is useful to reduce the amount of storage space required for Snapshots by only recording Snapshots when a keyword event is encountered.

Send email notification…  If this box is selected, the Client will deliver an alert in the form of an email or a MS Exchange message. You must configure the appropriate communications Server Type to deliver the alert

Once Every … Mins  This setting specifies the frequency to send alerts. To avoid sending a flood of alert messages, once an alert has been sent, the Client will NOT send a subsequent alert unless the configured number of minutes has passed

Server Type  This setting configures the communication method used to deliver the keyword message alert

Exchange Folder  This method configures a Microsoft Exchange public folder to deliver the keyword alert. Be sure to specify the public Folder Path to receive the keyword alert message. Example:  \All Public Folders\SpectorPublic

Note: The following link connects to information on setting up and configuring a MS Exchange public folder that will allow delivery of Alerts, but not allow them to be seen by others on the network. See Configuring MS Exchange Public Folder

Direct SMTP  This method will deliver the keyword alert as an email to a specified email address.

• The email will be delivered directly from the computer using the SMTP protocol to the SMTP server of the configured Email Address of the Client

• The advantage of using the Direct SMTP method over the Relay SMTP method is that the email delivery does not go through an intermediate SMTP server. This is most useful if you are on a network that does not provide access to an SMTP server, or you do not know the configuration parameters for the SMTP server on your network

• The disadvantage is that the SMTP server of the destination Email Address may not accept an email directly from the computer. The Advanced button can be used to configure a Domain name or IP address used in the header of the email being sent to identify it. This is useful for SMTP servers that may not accept an email from the domain name of the computer due to the default domain name present in the email header.  

Note: The default domain name for the computer is its IP address on the network.

Relay SMTP  This method will deliver the keyword alert as an email to the specified Email Address

• The email will be delivered to the email address by using the SMTP protocol to relay the email through an intermediate SMTP server.

• The intermediate SMTP server will be one:

• To which the computer has access on the network

• Of which you know the configuration and any necessary credentials

The Advanced button must be selected to configure the Mail Server name and any necessary credentials for accessing the SMTP Mail Server.

Note: An IP address can be configured instead of an SMTP server name for the Mail Server option. Port 25 is the default communication port used for SMTP, but it is possible that another port for an internal SMTP server is used. Contact your network administrator for more information.

If your network accesses the Internet through a proxy server, you will need to configure the proxy server for accessing the Relay SMTP Server. The proxy server must be a Web proxy server (HTMP proxy).  

1. Select the Computer Uses Proxy Server

2. Enter the IP address or server name as well as the proxy server’s IP port in the respective boxes

Test Email  

1. Select the Test Email button after configuring the Server Type options. This verifies that the settings are correct. A simple text message will be sent using the configured options to the destination email address or folder

2. Verify that the text message has been received at the destination email address or Exchange folder  

Note: See Alerts Troubleshooting for information on troubleshooting the SMTP or MS Exchange message delivery

Note: Most configurations for the Client Server Type will be made remotely. Performing a Test Email will only verify that the configured computer can deliver the test message. This does not necessarily mean that the computer being configured will be able to deliver the keyword alerts using the configured Server Type. It does verify that the destination email address or folder is properly configured.

Advanced>Optional Email Settings

If keyword alerts are configured for delivery using a Direct or Relay SMTP server, you can change the From and Subject fields of the delivered email alert.

• This may be desirable to differentiate email alerts from multiple Client monitored computers in the same email Inbox

• This may be desirable to hide the source of the email being received in your Inbox

Related Topics:

Keyword Alerts

Knowledge Base

Technical Support