Proofpoint | ObserveIT On-Premises Insider Threat Management

Copied Text Did What

This topic describes how to define alert rule conditions using the options available in the Copied Text group category in the Did what? section of the Create Alert Rule page. (For more about the Did what? section, see Defining the "Did What?" Conditions.)

This option is available for alert type rules on Windows and Mac-based operating systems.

To define the text content that will generate an alert

1. From the Copied Text option, select Text content.

   Select the relevant operator from the drop-down list in order to define the value(s) against which to test the condition.

   

2. Enter the required value(s) on which to test the condition.

   You can enter multiple values separated by commas either directly or by clicking the […] icon to open a popup in which you can enter the values. Alternatively, when Lists are supported (see Understanding Lists in ObserveIT), you can choose to select a predefined List instead of entering a set of values. By hovering over the values field, two icons appear that enable you to switch between the Values and List modes: or . When List mode is selected, a drop-down list shows all the predefined Public and Private lists that are authorized for this Console User. You can edit the list contents, if required. For details, see Editing Lists.

   Example

   Following is an example of a rule that will trigger an alert when confidential text such as a project name "voyager or VYG" is copied to the clipboard while Microsoft Word is running:

   

3. After the alert is generated, in the Alerts page, you can view the alert details showing the conditions that triggered the alert: