ALERT
Alert. An alert is triggered when abnormal activity is been detected.
Every unattested user input generates an alert, if they happen within the same second and all details are identical, one is sent with alert_count reflecting multiple user inputs.
Alerts can get triggered within a legitimate ongoing session, when additional unattested inputs are detected. In this case a session ID (sess_id) is present in the alert.
Besides the frequently used data points linked above, the alert specific ones are:
Alert count (alert_count)
The number of identical alerts with in the given second.
Alert session (alert_sess)
Alerts that happen within the same remote session on the terminator machine, share the same alert session identifier.
As an example if an attacker manages to start a remote desktop session to a server protected by a Keystrike terminator, all alerts triggered in that remote desktop session, share the same alert session identifier.
Alert type (alert_type)
- INPUT - Unattested input was detected.
- CSEQ - Possible attestation reuse was detected.
- RECOVERY_CODE_PROMPT - Recovery code prompt triggered by user.
- RECOVERY_CODE_ACCEPTED - Recovery code was used to exit enforcement mode.
- RECOVERY_CODE_REJECTED - Invalid recovery code was entered.
- DYNAMIC_MAPPING_CANCELLED - Dynamic mapping was cancelled by user.
Context (context)
An embedded JSON structure describing the context the user was in when the alert was triggered. This always includes
- path - the application in use, including full path.
- pid - the process ID of the application.
- input_action -
- "key" - if triggered by keyboard
- "pointer" - if triggered by a mouse click
When the user switches applications, the first alert for the new application contains more details on the application that may help with forensics.
Mode (mode)
- audit - the terminator was in audit mode only when this alert was triggered, not in enforcement mode.
- enforce - the terminator was in enforcement mode when the alert was triggered.
Terminator time (trm_time)
The date and time on the terminator machine when the alert occurred, this can differ from the "time", which is always UTC, while the terminator time may be in a different timezone.