Proofpoint | ObserveIT On-Premises Insider Threat Management

Pasted - Did What

This topic describes how to define alert rule conditions using the options available in the Pasted group category in the Did what? section of the Create Alert Rule page. (For more about the Did what? section, see Defining the "Did What?" Conditions.)

This option is available for alert type rules on Windows and Mac-based operating systems.

Alerts can be defined when a user pastes text, images, files and/or folders the clipboard.

Alerts are triggered by the keyboard and point-click paste actions:

• Right-click menu item: Paste

• Keyboard shortcuts: Ctrl+V, CTRL+Insert, Shift +Insert (Windows)

• Menu items: Edit > Paste and equivalent right-click menu items

• Keyboard shortcuts: Cmd+V (Mac)

You can define alerts to trigger when a user pastes:

• Any type: an alert is triggered when anything is pasted.

• Text: an alert is triggered when text is pasted. Using the relevant operator, you can define the value(s) for this condition.

• Files/Folders: an alert is triggered when the following is pasted -

  • Any file or folder.

  • A specific file or folder or you can use the relevant operator to define the value(s).

  • A file or folder with a specific source file or you can use the relevant operators to define the source folder value(s).

• Image: an alert is triggered when an image is pasted.

Operators: is not, contains, does not contain, starts with, does not start with, ends with, does not end with, empty, or not empty with these options.

Below is an example of an alert triggered when the text "Hello" was pasted.

Creating an Alert Rule for Pasted

1. In the Alerts & Prevent Rules tab, click the New Alerts Rule button. In the Create Rule page, fill in the Alert Rule Details and Rule Assignment sections. In the Detection Policy section, in the Did What? area. select Pasted.

2. Do one or more of the following:

   Create a rule to alert for any paste:

   • From the Pasted option, select Any type.

   Create a rule to alert when text is pasted:

   1. From the Pasted option, select Text.

   2. Select the relevant operator from the drop-down list in order to define the value(s) against which to test the condition.

   3. Enter the values or use a list, see Using Lists

   Create a rule to alert when files/folders are pasted:

   1. From the Pasted option, select Files/Folders.

   2. Select the relevant operator from the drop-down list(s) in order to define the value(s) against which to test the condition.

   3. Enter the values or use a list, see Using Lists

   Create a rule to alert when images are pasted:

   • From the Pasted option, select Image.

Using Lists

When lists are supported, you can choose to select a predefined list instead of entering a set of values. (see Understanding Lists in ObserveIT).

By hovering over the values field, two icons appear that enable you to switch between the Values and List modes: or .

When List mode is selected, a drop-down list shows all the predefined Public and Private lists that are authorized for this Console User that match the condition.  For details about editing lists, see Editing Lists.