ActivTrak's Alarms alert you in real time to activities that may pose security risks or affect data accuracy, allowing you to take immediate action. Alarms work like IF-THEN statements: when specified Conditions are met, they trigger defined Actions.
Contents
- What are Alarms?
- Privacy and compliance
- Types of Alarms
- How Alarms work
- Accessing Alarm configuration
- Out-of-the-box Alarms
- Learn more
What are Alarms?
Alarms monitor user activity and system events, notifying you when important events occur. They help you:
- Detect potential security threats
- Monitor policy compliance
- Protect sensitive data
- Track administrative changes
Privacy and compliance
ActivTrak is designed with privacy and compliance in mind:
- Role-based access: Control who can view and configure Alarms
- Targeted monitoring: Apply Alarms only to specific groups when needed
- Clear notifications: Inform users about monitoring through customizable pop-ups
- Documented audit trail: Maintain records of all triggered Alarms
Types of Alarms
ActivTrak offers three Alarm types to address different monitoring needs:
Monitor user activity on applications and websites. These Alarms track:
- Websites visited
- Applications used
- Time spent on activities
- Text in application titles
- Specific executable files
Alert you when USB devices are connected to or disconnected from monitored computers. Use these to:
- Track external storage device usage
- Prevent unauthorized data transfers
- Maintain compliance with data security policies
Notify you about changes to your ActivTrak account, including:
- Administrative logins
- User permission changes
- Agent installations or removals
- Data exports
- Privacy setting modifications
How Alarms work
Alarms follow a simple IF-THEN structure.
IF: Define one or more Conditions
that will
trigger the
Alarm
|
THEN: Specify one or more Actions
to occur when
conditions
are met
|
*Available Conditions and Actions depend on the type of Alarm, the plan type and enabled add-ons. See Accessing Alarm Configuration below for specific details about what's included with your setup.
Accessing Alarm configuration
The user role types that can view Alarms are Admins, Configurators and Power Users. Only Admins and Configurators can edit or enable Alarms. Viewers are unable to access any Alarm pages.
To update Alarm access permissions, navigate to Settings > Access > Role Access. To learn more about customizing user roles in ActivTrak, click here.
Conditions availability
Certain Alarm Conditions, such as the title bar and URL, are considered sensitive data by ActivTrak. Alarm data collection captures titlebar and URL information; however, what you see in your alarm logs depends on the type of Alarm, the plan type and enabled add-ons. Your account's Sensitive Data Visibility setting determines the level of detail displayed.
| Condition | Alarm Type | ActivTrak Plans* | Legacy Plans** |
|---|---|---|---|
| Title bar | Activity | with Essentials Plus and Professional plans or with the Screen Details Add-on |
with
Advanced Details selected |
| URL | Activity |
domain only (e.g., activtrak.com) with Essentials plan complete URLs with Essentials Plus and Professional plans or with the Screen Details Add-on |
with
Advanced Details selected |
**Advanced and Premium
Actions availability
The availability of specific Actions depends on the type of Alarm, the plan type and enabled add-ons. We have summarized Action availability in the following table.
| Action | Alarm Type | ActivTrak Plans* | Legacy Plans** |
|---|---|---|---|
| Screen Captures | Activity & USB | with Screen Details (Add-on) |
with
Full Details selected |
| Pop-up Messages | Activity & USB | with Screen Details (Add-on) |
with
Full Details selected |
| Email Notifications | all alarm types | all plans | all plans |
| External Notifications | all alarm types | all plans | all plans |
| Application Termination | Activity | with Screen Details (Add-on) |
with
Full Details selected |
| Alarm Risk Level | Activity & USB | all plans | all plans |
**Advanced and Premium
Out-of-the-box Alarms
ActivTrak includes several pre-configured Alarms for common scenarios. To enable these Alarms, which are turned off by default, visit the Alarms Configuration page via Notifications > Compliance Alarms > Alarm Configuration and toggle them on.
|
Potential Mouse-jiggler or False Activity |
Use these Alarms to identify the potential use of mouse jigglers or activity-mimicking tools. Learn more about detecting mouse jigglers and other activity-mimicking tools here.
PFA: High Duration Activity: Toggle on to receive alerts when a user spends longer than 45 minutes (by default) on a single screen. You can customize the time duration in the Conditions of this Alarm
PFA: Input Simulation Software: Toggle on to get immediate alerts when users may be using mouse jigglers or other software that simulates activity.
PFA: Repetitive Activity: Toggle
on
to be
notified when repetitive patterns that don't look
like
natural
human behavior are detected. For more information
about these patterns, see
this article.
To prevent this activity from
skewing report data, the
Active Time settings
will automatically stop the activity after 60 minutes
by
default. You can adjust this duration. |
| Adult Content Accessed | Toggle on to be alerted when a user accesses an adult content site, such as Pornhub, helping maintain workplace standards and policy compliance. |
| AI Usage | Toggle on to be notified when users access AI tools, such as ChatGPT. Helps monitor unauthorized AI platform usage for oversight and risk assessment, aligning with your organization's AI policies. |
| Entertainment Break | Toggle on to track when users access entertainment sites during work hours, helping you understand non-work-related digital activities. |
| File Sharing | Toggle on to receive alerts when users access file-sharing platforms such as Dropbox, which allows you to monitor potential data movement outside approved channels. |
| PII Accessed | Toggle on to be alerted when users access sensitive, personally identifiable information (PII) such as social security numbers. Helps compliance officers protect sensitive data and ensure access is limited to authorized personnel only. |
| Potential Job Search | Toggle on to receive notifications when users access job search sites, such as Indeed.com, providing early indicators of potential turnover. |
| Social Media Break |
Toggle on to be alerted when users access social media sites, such as Facebook.
Note: This Alarm is only available to customers with accounts created before May 29, 2024. Learn how to create a custom Alarm with similar functionality. |
| New Activity Screenshot |
Toggle on to capture a screenshot when a user has been active in a new application or website for 20 seconds.
Note: This Alarm requires the Screen Details add-on and is only available to customers with accounts created before May 29. 2024. Learn how to create a custom Alarm with similar functionality. |
| Blocked Website Accessed |
This is turned on by default. Users who visit websites in the blocked website list will automatically be redirected to this page. This Alarm triggers when a user hits this redirect page, keeping a record of attempted access to blocked content.
Note: This Alarm is only available to customers with accounts created before May 29, 2024. Learn how to create a custom Alarm with similar functionality. |
| Data Saved to USB Device |
Toggle on to be alerted when users transfer data to USB devices, helping protect sensitive information.
Note: The ActivTrak Agent doesn't have access to content written on USB devices. When this Alarm triggers, check the user's Activity Log to understand their actions around that time. |
| ActivTrak User Deleted | Triggers when a user or computer is deleted from your account, helping maintain a complete audit trail of account modifications. |
| Agent Potentially Uninstalled | Triggers when a user attempts to uninstall the ActivTrak Agent from their device, alerting you to potential gaps in monitoring. |
| Alarm Deleted | Triggers when an Admin deletes an alarm in the account, maintaining transparency in security configuration changes. |
| Computer Not Reporting | Triggers when an installed ActivTrak Agent stops reporting data, allowing IT managers to quickly identify and resolve issues with monitoring coverage. |
Updating out-of-the-box Alarms
To review and update the settings for the pre-configured alarms:
- Navigate to the Alarms Configuration page via Notifications > Compliance Alarms > Alarm Configuration
- Click the blue Edit button to the right of the Alarm of choice
- In the Group Alarm panel, the Selected Groups is set to “All Users and Computers” by default. To modify, click the box to open a dropdown of your ActivTrak Groups.
If the Alarm is set to trigger either the Pop-up Messages or the Application Termination actions, the Selected Groups must be set to “All Users and Computers.”
Note: This step only applies to creating Activity Alarms.
- The Conditions panel contains a list of pre-configured triggers that can be edited or deleted. To add a new rule to trigger the Alarm, click the Add Condition button at the bottom of the list.
“Match Any” is the default and recommended setting. The “Match All” setting should be reserved for when you require all listed conditions to be met for the Alarm to trigger. This selection is found at the top of the Conditions list.
Note: For more information on adding and editing Conditions, please refer to this page.
- Configure the Actions panel in order to be alerted when an Alarm is triggered:
Note: For more information on adding and editing Actions, please refer to this page.
- After configuring the Alarm, click the green Save button at the bottom.
-
Verify that the Alarm is active. The toggle should be blue in the Status column on the Alarm Configuration page.