Alert overview

Terminators attest every input action, both keystrokes and mouse clicks. When an input action is not coming from a workstation with a legit Keystrike client, and thus not attested, an alert is triggered.

Every unattested input action triggers an alert. These alerts are captured in detail in the activity logs and can be pushed to 3rd party systems such as the organization's SIEM system via a Web hook.

If the terminator is in Enforcement mode the unwelcome user is blocked and will likely not trigger many alerts per session. In audit mode the user may well trigger many alerts in one session as input actions are not blocked.

The admin panel displays alerts grouped by session, showing the duration from the first to the last alert, and number of alerts generated in a given session. Key information such as the terminator device and logged in user on the terminator device are highlighted.

The dashboard highlights alerts that occurred during the last day there were any alerts. On the alerts page, alerts can be browsed back in time by selecting the given day.

By selecting an alert session you can see more details, such as the context in which the alerts occurred, where the application being used on the terminator machine is highlighted. For further drill down into details, the activity logs show alerts for each input action and more details on the context.