Spector CNE
|
|
Administrator's Guide |
Configure the flexible Keyword Alerts options from:
Client Deployment Utility - Pre-configure the recording options in the Client installation file.
Control Center >Configure Computer View > Client Settings - Select individual options to enable or disable.
Spector Client is configured to Record Keyword Alerts events by selecting options within the Alerts configuration tab.
Monitor the activity of a computer's user and detect keywords that occur within other recorded events. A Keyword event occurs when a pre-defined word or phrase is found in a Web site, Email, Keystroke, or Chat/IM event. When the keyword is detected, the Client can immediately send a message to warn you of the event. The Client can also increase the rate of Snapshot recording in order to be certain that all details of the activity on the computer are recorded.
Create the keywords list the Client to use for scanning recorded
events. The keyword can include any character, including spaces.
When the keyword list is modified for a computer that is already running the Client, the new keyword list will not take effect until the current user on the computer logs off and a subsequent log on takes place. The previous keyword list will continue to remain in effect until the user logs off.
New - Add a keyword or phrase into the keyword list.
Delete - Delete keyword or keywords from the list. Select and click Delete or use the keyword Delete key.
Export - Exported all keywords in the list to a text file. You can import this list to another Client.
Import - A text file containing keywords can be imported to add keywords to the keyword list. The Import function expects one keyword to be on each line and as an option, each keyword followed by a space and then number “1” or number “0”
Select the Match whole word only option if you want the keyword you entered to ONLY match if that keyword is encountered by itself and NOT part of another word.
When importing or adding keywords, duplicate keywords are not removed.
Be specific when entering keywords. Smaller words that are common will only generate a flood of alerts. For example: If you want to know when an Instant Message conversation is exchanged with a person called, “HeadHunter,” use the keyword "HeadHunter” or “Head Hunter” and not simply the keyword “head.”
The keyword must be surrounded by non-alphanumeric characters. For example, if the keyword is “sex” and the Match whole word only option is selected, then the Client will not detect a keyword match for the word “Essex”, even though it contains the spelling for the word “sex”. If the keyword is “sex” and the Match whole word only option is selected, then the Client will detect a keyword match for the URL www.sex.com because the word “sex” is framed by non-alphanumeric characters. Enable this option to avoid receiving many unnecessary alerts for keywords contained within other words.
When keywords are exported to a file, each line contains the keyword followed by a space and then either a 1 or 0.
Number “1” signifies that Match whole word only is enabled for that keyword.
Number “0” signifies that Match whole word only is NOT enabled for that keyword.
If the line does not end in a space and number “1” or a space and number “0”, the Client will assume that Match whole word only is to be enabled and the entire line is the keyword.
Examples
|
Text Line Imported |
Keyword Resulting |
Whole Word Match |
|
Business 1 |
Business |
Yes |
|
Job Hunt 0 |
Job Hunt |
No |
|
Job Hunt 1230 |
Job Hunt 1230 |
Yes |
|
Business |
Business |
Yes |
|
Note Any line beginning with the “#” character is considered to be a comment and will be ignored when importing keywords. |
When a keyword is detected within other recorded events, a Keyword event is recorded. The Client can take the following actions when the Keyword event is recorded:
Send Email Notification - Enable email notification alerting when a Keyword event has occurred. The Client will deliver an alert in the form of an email or a MS Exchange message. You must configure the appropriate communications Server Type to deliver the alert.
Advanced - Configure the advance email settings. See Advanced Email Alerts Options.
Once Every … Mins - This setting specifies the frequency to send alerts. To avoid sending a flood of alert messages, once an alert has been sent, the Client will NOT send a subsequent alert unless the configured number of minutes has passed.
Server Type - This setting configures the communication method used to deliver the keyword message alert. Use the Advanced settings configure the Mail Server name and any necessary credentials for accessing the server. See Server Type options discussion below.
Capture Snapshots on Alert - If this box is selected, the Client will capture Snapshots for the configured frequency and duration. This can be useful to ensure that details of what was happening on the computer are recorded by increasing the Snapshot frequency to be greater than what is configured in the Snapshot settings.
|
Note If Snapshot recording is disabled, selecting Capture Snapshots on Alert will still capture Snapshots only for the specified period. This is useful to reduce the amount of storage space required for Snapshots by only recording Snapshots when a keyword event is encountered. |
The email will be delivered directly from the computer using the SMTP protocol to the SMTP server of the configured Email Address of the Client.
The advantage of using the Direct SMTP method over the Relay SMTP method is that the email delivery does not go through an intermediate SMTP server. This is most useful if you are on a network that does not provide access to an SMTP server, or you do not know the configuration parameters for the SMTP server on your network.
The disadvantage is that the SMTP server of the destination Email Address may not accept an email directly from the computer. The Advanced button can be used to configure a Domain name or IP address used in the header of the email being sent to identify it. This is useful for SMTP servers that may not accept an email from the domain name of the computer due to the default domain name present in the email header.
|
Note The default domain name for the computer is its IP address on the network. |
The email will be delivered to the email address by using the SMTP protocol to relay the email through an intermediate SMTP server.
The intermediate SMTP server will be one:
To which the computer has access on the network
Of which you know the configuration and any necessary credentials
|
|
The configured From address should be a valid email address or many SMTP servers will NOT accept email. |
|
|
If using a Direct or Relay SMTP server, you can change the From and Subject fields of the delivered email alert to:
|
This option configures a Microsoft Exchange public folder to deliver the keyword alert. Be sure to specify the public Folder Path to receive the keyword alert message. Example: \All Public Folders\SpectorPublic. See Configuring a MS Exchange Public Folder for Keyword Alerts for how to information.
An IP address can be configured instead of an SMTP server name for the Mail Server option. Port 25 is the default communication port used for SMTP, but it is possible that another port for an internal SMTP server is used. Contact your network administrator for more information.
If your network accesses the Internet through a proxy server, you will need to configure the proxy server for accessing the Relay SMTP Server. The proxy server must be a Web proxy server (HTMP proxy).
Configuring a MS Exchange Public Folder for Keyword Alerts
