Dashboard<\/h3>\n
Navigate to Shield+ > Dashboard<\/strong> (the default view). It presents a summary of security alerts raised by the system’s Machine Learning models – the most important signal in the platform.<\/p>\n Time alerts<\/strong> – Three cards show alert counts; click on each to see more details<\/p>\n Alert types<\/strong> – Filter alert types<\/p>\n Scope – <\/strong>Used to select the users you want to view the dashboard for.<\/p>\n The daily alert distribution line chart shows alert volume over the past 30 days.<\/p>\n Clicking any point on the chart navigates directly to the matching filtered alerts list. It can be expanded by zooming in\/out as well as downloaded as PNG, JPEG, or CSV.<\/p>\n It can also be expanded to full screen and downloaded as such<\/p>\n Navigate to Shield+ > Dashboard<\/strong><\/p>\n The Audit section is a read-only section for logs and alert tables for every detection module for ActiveID<\/strong>, Device performance, Anti-Phishing,<\/strong> and Copy and Paste<\/strong><\/p>\n TypingID<\/strong> Alerts<\/strong> – A paginated table of every TypingID alert – events where the Machine Learning model determined, with confidence above the rule’s threshold, that the person typing is likely not the legitimate account owner. Each alert records the user, timestamp, confidence percentage, and current status.<\/p>\n TypingID<\/strong> Patterns<\/strong> – The raw typing patterns collected from users and processed by the AI models. This view lets admins monitor how actively patterns are being generated per user, which directly reflects how well each user’s identity model is trained.<\/p>\n Scope<\/strong> – filter by user, domain, group, or org. unit.<\/p>\n Navigate to Shield+ > Audit > ActiveID > TypingID > Alerts or Patterns<\/strong><\/p>\n Inactivity lock – Alerts<\/strong> are raised when an inactivity lock challenge is triggered, but the user failed to respond, responded incorrectly, or let the request time out. Each record shows the user, trigger time, and the specific failure reason (e.g., verification failed, timed out, credential not found).<\/p>\n Device performance<\/strong> is measured by the stats of alerts\u00a0raised when a user’s device CPU or memory usage exceeded a configured threshold for a sustained period. Each alert records the affected user, the resource (CPU or Memory), the metric (Maximum or Average), and the duration.<\/p>\n Navigate to Shield+ > Audit > Device performance > Alerts or Measurements\u00a0<\/strong><\/p>\n Anti-Phishing Alerts<\/strong> \u2013 A paginated table of alerts generated by Anti-Phishing activity. Admins can review which user and URL were involved, when the event happened, which rule or policy applied, and the current alert status.<\/p>\n This view is used to inspect Anti-Phishing outcomes such as blocked access or warning\/override events when browser enforcement is enabled. Admins can review alert details, update severity or status, acknowledge alerts, and decide whether a domain should be added to Allowed Websites or Blocked Websites.<\/p>\n Allowed and Blocked Websites are configured under Security Configuration. The Audit view is for reviewing Anti-Phishing alerts, not managing those lists.<\/p>\n Navigate to Shield+ > Audit > Anti-Phishing > Alerts\u00a0<\/strong><\/p>\n A log of all copy and paste events captured from users’ browsers.<\/p>\n Each entry shows the URL where the event occurred, the event type (Copy Allowed, Copy Blocked, Paste Allowed, Paste Blocked), and the user who triggered it.<\/p>\n Navigate to Shield+ > Audit > Copy\/Paste\u00a0<\/strong><\/p>\n The Admins can review flagged events, inspect details, and acknowledge alerts from these views.<\/p>\n The Admins create and manage rules, policies, and lists that control how Shield+ detects threats and enforces actions.<\/p>\n Changes here directly affect what gets flagged and what happens to users when a violation is detected.<\/p>\n ActiveID<\/strong> is a feature of continuous typing verification. It creates a profile of a user based on typing characteristics. In order to create a profile, it will have to record the user’s typing patterns (but only timing characteristics, no actual words typed are recorded) for some time. Then it starts to verify every new pattern that comes to the app and decides whether it matches the profile or not. Based on the advanced logic of Machine Learning algorithms, it can decide whether the person who is typing is the actual user logged into their account or an imposter who gained unauthorised access to the account. In the latter case, the GAT Shield+ ActiveID feature will raise an alert, notifying the admin of the domain and (optionally) logging out the person who is typing from the account.<\/p>\n Create and manage the alert rules that govern when TypingID alerts fire. Each rule defines: the scope (which users it applies to), the prediction threshold (confidence level above which an alert is triggered), alert recipients and notification settings, optional alert attachments (screenshot, webcam capture, visited URL), and the action on violation – either no session action, a Passkey challenge (screen locked until the user verifies their identity), or clearing browser cookies (effectively ending all active sessions). Rules can be activated or deactivated without deleting them.<\/p>\n Navigate to Shield+ > Security configuration> ActiveID > TypingID > Rules > + New TypingID rule<\/strong><\/p>\n Configure policies that define how long a user can be inactive before Shield+ requires identity verification in the browser. Each policy specifies the inactivity period in minutes and the scope of users it covers. When the inactivity threshold is reached, Shield+ requires the user to verify with Passkey before continuing.<\/p>\n Navigate to Shield+ > Security configuration > ActiveID > Inactivity Lock > Scopes and Timers > New inactivity lock rule<\/strong><\/p>\n A list of website hosts excluded from immediate inactivity locking – intended for sites like video meetings, for example, meet.google.com<\/strong>, where users may be present without typing or moving the mouse.<\/p>\n Entries are host names only, not full URLs.<\/p>\n When a user on an excluded host reaches their inactivity period, Shield+ asks them to confirm they are still present before locking. If confirmed, the next inactivity check is deferred by the configured inactivity period, up to 30 minutes.<\/p>\n Navigate to Shield+ > Security configuration > ActiveID > Inactivity Lock >\u00a0 Website exclusions > Add host<\/strong><\/p>\n View and manage “Passkey” credentials registered by users for identity verification challenges. Admins can see which users have registered credentials, how many credentials they have, and when they were last used. Revoking credentials for a user forces that user to register a Passkey again on their next verification prompt.<\/span><\/p>\n Passkey adds an extra identity check inside the Shield+ browser extension. It is used when the organization wants to make sure the person using the browser is still the correct user.<\/p>\n Work for the end-user.<\/p>\n Shield+ does not store the user\u2019s password or biometric data. The device keeps the private part of the passkey. GAT\/Shield+ stores the registered credential information needed to check that future passkey responses are valid.<\/p>\n When Passkey Is Used<\/b><\/p>\n Passkey can be required in two main situations:<\/p>\n If the user has been inactive for a configured number of minutes, Shield+ locks browsing<\/strong> and asks for passkey verification before the user can continue.<\/strong><\/p>\n If ActiveID detects unusual typing behavior, an administrator can configure the response to require passkey verification. This helps reduce false positives: instead of immediately treating the activity as unauthorized, the user can prove they are really present.<\/p>\n There is also an administrator-forced security check path in the extension, but the main user-facing configuration is Inactivity Lock and ActiveID Passkey action.<\/p>\n Administrator Configuration<\/b><\/p>\n Navigate to Security configuration > ActiveID > TypingID > Rules > New TypingID rule\u00a0<\/strong><\/p>\n If a user is asked to verify but has no passkey yet, Shield+ sends them to the passkey setup page.<\/p>\n After setup, they can use the passkey for future security checks. If the user later adds another passkey, Shield+ may ask them to verify first.<\/p>\n Set up passkey as follows.<\/p>\n From the admin console, you manage the passkeys.<\/p>\n Create and manage Anti-Phishing alert rules. Each rule defines the scope, notification recipients, and browser action settings for detector results. Admins can choose whether detector warnings and blocking should interrupt the user in the browser, and can configure the severity threshold at which detector block results become hard blocks. Administrator-blocked websites are always blocked by policy.<\/p>\n Rules –\u00a0<\/strong>Define and create new anti-phishing rules.<\/p>\n Navigate to Shield+ > Security configuration > Anti-Phishing > New anti-phishing rule<\/strong><\/p>\n Domains manually added by admins to control Anti-Phishing behavior.<\/p>\n Allowed Websites are trusted domains where pages bypass Anti-Phishing checks and can override administrator-blocked domain entries. Blocked Websites are domains that are always treated as phishing threats and blocked for users by administrator policy.<\/p>\n Entries are saved as site domains. The current UI accepts domains only. Protocols, ports, paths, and wildcards are not accepted in these fields.<\/p>\n Allowed Websites: Add a domain that should be trusted by Anti-Phishing protection.<\/p>\n Valid format:<\/p>\n Blocked Websites: Add a domain that should always be treated as a phishing threat by Anti-Phishing protection.<\/p>\n Valid format:<\/p>\n Set up a performance rule for the device resource monitoring. Each rule can specify a performance source; it can be CPU or Memory, the metric (Maximum or Average readings), the timeframe the condition must hold (15, 30, or 60 minutes), the threshold percentage, and notification recipients.<\/p>\n Navigate to Shield+ > Security configuration > Device performance > New perormance rule<\/strong><\/p>\n Fill in the required details such as Source, Metric, and Time condition<\/p>\n Configure copy and paste restrictions across the domain.<\/p>\n Two modes: Allow All (copy\/paste permitted everywhere by default – specific URLs can be added to block) or Block All (copy\/paste denied everywhere by default – specific URLs can be added to allow).<\/p>\n URL entries support wildcards ending with `\/*` to cover child paths.<\/p>\n Navigate to Shield+ > Security configuration > Copy \/ Paste > New copy\/paste rule<\/strong><\/p>\n Real-time visibility into users’ Chrome browser activity. The monitored user’s browser always displays a visible indicator that monitoring is active.<\/p>\n (Note, the user browser will indicate that it is being actively monitored.)<\/p><\/blockquote>\n The Admin can view one or more users’ live browser screens in real time. After selecting a monitoring target (user, group, or OU), the admin sees thumbnails of all open tabs and windows. Available tab actions: switch the user to a specific tab, open a new tab for the user at a given URL, close a tab on the user’s behalf, or open a copy of the tab in the admin’s own browser.<\/p>\n Navigate to Shield+ > Monitoring > Browser monitoring > Scope – select the scope of users to monitor<\/strong><\/p>\n Pre-configured groups that delegate browser monitoring authority to supervisors or managers without requiring admin involvement each time.<\/p>\n Each group defines Targets (users whose browsers can be monitored) and Auditors (people permitted to start monitoring sessions). Once a group is set up, any assigned auditor can initiate monitoring directly from the group’s page.<\/p>\n Navigate to Shield+ > Monitoring > Monitoring groups > New monitoring group<\/strong><\/p>\n Forwards Shield+ security events to external systems such as SIEM platforms, log aggregators, or custom webhook endpoints.<\/p>\n Navigate to Shield+ > Webhooks & SIEMs > New Sink > New Sink<\/strong><\/p>\n Fill in the details. Choose the receiving Sink system (e.g., SIEM) and configure credentials. Depending on the type of the receiver system, you need to provide the full URL and either an authorization token or a set of HTTP headers to be included in every request.<\/p>\n Delegate Shield+ audit access to users who are not domain administrators. Auditors can be granted access to specific feature areas – ActiveID, Anti-Phishing, Device Performance, Copy\/Paste, Browser Monitoring, or Webhooks & SIEM – and optionally scoped to a specific set of users, groups, or organizational units, so each auditor sees only the data relevant to their team.<\/p>\n Navigate to Shield+ > Delegated auditor<\/strong><\/p>\n Fill in the details, select the scope type, who will be the auditor, and the scope – what users will be monitored<\/p>\n Admin-only settings for the Shield+ deployment.<\/p>\n Manage the deployment of the Shield+ browser extension across the domain. The extension is installed on user machines and is the component that collects typing patterns, enforces copy\/paste policies, enables browser monitoring, and displays anti-phishing blocking pages.<\/p>\n A complete audit trail of all administrative actions taken within Shield+: logins, creation, update, and deletion of alert rules and policies, browser monitoring session starts and stops, configuration changes, and data exports.<\/p>\n Each entry records the responsible administrator, the timestamp, and the full details of every change, including before-and-after comparisons where applicable.<\/p>\n Managing security across a distributed enterprise domain requires visibility that goes beyond static firewalls and standard login prompts. Shield+<\/b> delivers this exact layer of deep, behavioral protection right at the edge – inside the browser where your users spend their workday.<\/p>\n By deploying Shield+, you aren\u2019t just monitoring your enterprise domain; you are actively hardening it against the modern threat landscape while maintaining full visibility and administrative control.<\/p>\n\n
\n
\n
Daily Alerts Distribution<\/h3>\n
![\"Dashboard](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-12_43_44-Downloads-File-Explorer.png\")
<\/p>\nAudit<\/h2>\n
ActiveID – TypingID<\/h3>\n
TypingID<\/strong> Alerts<\/strong><\/h4>\n
\n
TypingID<\/strong> Patterns<\/strong><\/h4>\n
\n
\n
![\"The](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-15_33_12-.png\")
<\/p>\nInactivity Lock<\/strong><\/h4>\n
Device performance<\/h4>\n
\n
![\"Device](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_32_21-Downloads-File-Explorer.png\")
<\/p>\nAnti-Phishing<\/h4>\n
![\"Navigate](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-18_50_31-.png\")
<\/p>\nCopy \/ Paste<\/h4>\n
![\"Copy](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_05_17-.png\")
<\/p>\nSecurity Configuration<\/h2>\n
ActiveID<\/h3>\n
TypingID Rules<\/h3>\n
![\""Create\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_55_46-.png\")
<\/p>\nCreate a typingID rule<\/h4>\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Inactivity Lock<\/h3>\n
Scopes and Timers<\/h4>\n
![\""Name\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_17_49-Downloads-File-Explorer.png\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
![\"Name](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-19_23_58-Settings.png\")
<\/p>\n\n
\n
\n
\n
\n
Website Exclusions<\/h4>\n
![\"A](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_24_27-.png\")
<\/p>\nPasskey – Credential management<\/h3>\n
\n
\n
\n
![\"Navigate](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-19_27_04-.png\")
<\/p>\n\n
First-Time User Experience: <\/b><\/h5>\n
\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-19_31_46-.png\")
<\/p>\nWhat the Admin Controls<\/h4>\n
\n
Anti-Phishing<\/strong><\/h3>\n
![\""Name\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_34_00-.png\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
![\"Name](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-19_38_03-Settings.png\")
<\/p>\n\n
\n
\n
\n
\n
Allowed Websites \/ Blocked Websites<\/h3>\n
\n
\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-07-07-19_43_11-Greenshot.png\")
<\/p>\nDevice Performance – Performance Rules<\/h4>\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_56_23-.png\")
<\/p>\nCopy \/ Paste<\/h4>\n
\n
\n
![\""Navigate\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_02_01-Greenshot.png\")
<\/p>\nMonitoring<\/h2>\n
Browser Monitoring<\/h3>\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_16_55-.png\")
<\/p>\nMonitoring Groups<\/h3>\n
![\"Pre-configured](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_20_55-.png\")
<\/p>\nWebhooks & SIEM<\/h2>\n
\n
![\""Forwards\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_25_31-Greenshot.png\")
<\/p>\nDelegated Auditors<\/h2>\n
![\""Navigate\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_30_09-.png\")
<\/p>\nConfiguration<\/h3>\n
Admin Log<\/h3>\n
Conclusion: Why Shield+ is Essential for Your Enterprise<\/h2>\n
Key Benefits for Enterprise Admins<\/h2>\n
\n
Related Posts<\/h2>\n