Dashboard<\/h2>\n
Navigate to Shield+ and click on Dashboard (the default view). It presents a summary of security alerts raised by the system’s Machine Learning models – the most important signal in the platform.<\/p>\n
Time alerts<\/strong> – Three cards show alert counts for<\/p>\n Alert types<\/strong> – The alert types can be filtered for<\/p>\n The scope is used to select the users you want to view the dashboard for.<\/p>\n The daily alert distribution line chart shows alert volume over the past 30 days.<\/p>\n Clicking any point on the chart navigates directly to the matching filtered alerts list. It can be expanded by zooming in\/out as well as downloaded as PNG, JPEG, or CSV. It can also be expanded to full screen and downloaded as such<\/p>\n Navigate to Shield+ > Dashboard<\/strong><\/p>\n The Audit section is a read-only section for logs and alert tables for every detection module for ActiveID<\/strong>, Device performance,<\/strong> and Copy and Paste<\/strong><\/p>\n The ActiveID<\/strong> has typing and inactivity alerts<\/p>\n Navigate to Shield+ > Aduit > ActiveID > TypingID > Alerts or Patterns<\/strong><\/p>\n Navigate to Shield+ > Audit > Device performance > Alerts or Measurements\u00a0<\/strong><\/p>\n A log of all copy and paste events captured from users’ browsers.<\/p>\n Each entry shows the URL where the event occurred, the event type (Copy Allowed, Copy Blocked, Paste Allowed, Paste Blocked), and the user who triggered it.<\/p>\n Navigate to Shield+ > Audit > Copy\/Paste\u00a0<\/strong><\/p>\n The Admins can review flagged events, inspect details, and acknowledge alerts from these views.<\/p>\n Where admins create and manage rules, policies, and lists that control how Shield+ detects threats and enforces actions. Changes here directly affect what gets flagged and what happens to users when a violation is detected.<\/p>\n ActiveID<\/strong> is a feature of continuous typing verification. It creates a profile of a user based on typing characteristics. In order to create a profile, it will have to record the user’s typing patterns (but only timing characteristics, no actual words typed are recorded) for some time. Then it starts to verify every new pattern that comes to the app and decides whether it matches the profile or not. Based on the advanced logic of Machine Learning algorithms, it can decide whether the person who is typing is the actual user logged into their account or an imposter who gained unauthorised access to the account. In the latter case, the GAT Shield+ ActiveID feature will raise an alert, notifying the admin of the domain and (optionally) logging out the person who is typing from the account.<\/p>\n Create and manage the alert rules that govern when TypingID alerts fire. Each rule defines: the scope (which users it applies to), the prediction threshold (confidence level above which an alert is triggered), alert recipients and notification settings, optional alert attachments (screenshot, webcam capture, visited URL), and the action on violation – either no session action, a Passkey challenge (screen locked until the user verifies their identity), or clearing browser cookies (effectively ending all active sessions). Rules can be activated or deactivated without deleting them.<\/p>\n Navigate to Shield+ > Security configuration> ActiveID > TypingID > Rules > + New typingID rule<\/strong><\/p>\n Configure policies that define how long a user must be inactive before an inactivity lock is applied. Each policy specifies the inactivity period in minutes and the scope of users it covers. Can be configured to trigger either a screen lock or a Passkey verification challenge.<\/p>\n Navigate to Shield+ > Security configuration > ActiveID > Inactivity Lock > Scopes and Timers<\/strong><\/p>\n A list of website hosts excluded from the inactivity lock – intended for sites like video meetings (e.g. meet.google.com) where users are present but not actively typing.<\/p>\n When a user on an excluded site reaches their inactivity period, Shield+ prompts them to confirm they’re still there instead of locking immediately. If confirmed, the lock is deferred for up to 30 minutes.<\/p>\n Navigate to Shield+ > Security configuration > ActiveID > Inactivity Lock >\u00a0 Website exclusions\u00a0<\/strong><\/p>\n Credential management is an automated browser lock that prevents unauthorized users from accessing a device when it is left unattended.<\/p>\n The end-user creates a passkey required by your organization for Shield+ security checks. A pop-up window where the user must create a passkey to log in and use the Chrome browser.<\/p>\n Choose where to create your passkey for the Chrome extension.<\/p>\n From the admin console, you manage the passkeys.<\/p>\n Rules –\u00a0<\/strong>Define and create new anti-phishing rules.<\/p>\n Alert rules that fire when a phishing event occurs (site blocked, user override, or a managed-list change). Each rule defines the scope, notification recipients, and whether the site-blocking UI (an Alert Banner Message) is shown to the user. If the event severity is Critical, the site is blocked outright with no option to override; lower-severity events show the banner and allow the user to proceed.<\/p>\n Navigate to Shield+ > Security configuration > Anti-Phishing > New anti-phishing rule<\/strong><\/p>\n Domains and URLs are manually added to the denylist\/allowlist by admins. Shield+ also maintains an internal threat database updated daily from external sources; manually added entries supplement that list. Both entire domains and specific page paths can be blocked\/allowed.<\/p>\n Add\u00a0domains<\/span> to allow through phishing protection. Use wildcards (*) to match multiple domains. Allowlisted domains bypass ALL phishing checks. Only add domains you absolutely trust. Overly broad patterns can compromise security.<\/p>\n Enter the allowed domain.<\/p>\n Add\u00a0URLs<\/span>\u00a0or\u00a0domains<\/span> to block as phishing threats. All patterns must include a proper domain with a TLD. Any matching pattern will allow the URL. If you blocklist\u00a0example.com<\/span>, ALL pages on that domain are allowed. Only add domains you know are a threat. Overly broad patterns can result in legitimate sites being blocked.<\/p>\n Set up a performance rule for the device resource monitoring. Each rule can specify a performance source; it can be CPU or Memory, the metric (Maximum or Average readings), the timeframe the condition must hold (15, 30, or 60 minutes), the threshold percentage, and notification recipients.<\/p>\n Navigate to Shield+ > Security configuration > Device performance > New perormance rule<\/strong><\/p>\n Fill in the required details such as Source, Metric, and Time condition<\/p>\n Configure copy and paste restrictions across the domain.<\/p>\n Two modes: Allow All (copy\/paste permitted everywhere by default – specific URLs can be added to block) or Block All (copy\/paste denied everywhere by default – specific URLs can be added to allow).<\/p>\n URL entries support wildcards ending with `\/*` to cover child paths.<\/p>\n Navigate to Shield+ > Security configuration > Copy \/ Paste > New copy\/paste rule<\/strong><\/p>\n Real-time visibility into users’ Chrome browser activity. The monitored user’s browser always displays a visible indicator that monitoring is active.<\/p>\n (Note, the user browser will indicate that it is being actively monitored.)<\/p><\/blockquote>\n The Admin can view one or more users’ live browser screens in real time. After selecting a monitoring target (user, group, or OU), the admin sees thumbnails of all open tabs and windows. Available tab actions: switch the user to a specific tab, open a new tab for the user at a given URL, close a tab on the user’s behalf, or open a copy of the tab in the admin’s own browser.<\/p>\n Navigate to Shield+ > Monitoring > Browser monitoring > Scope – select the scope of users to monitor<\/strong><\/p>\n Pre-configured groups that delegate browser monitoring authority to supervisors or managers without requiring admin involvement each time.<\/p>\n Each group defines Targets (users whose browsers can be monitored) and Auditors (people permitted to start monitoring sessions). Once a group is set up, any assigned auditor can initiate monitoring directly from the group’s page.<\/p>\n Navigate to Shield+ > Monitoring > Monitoring groups > New monitoring group<\/strong><\/p>\n Forwards Shield+ security events to external systems such as SIEM platforms, log aggregators, or custom webhook endpoints.<\/p>\n\n
\n
Scope<\/h2>\n
\n
Daily Alerts Distribution<\/h2>\n
![\"Dashboard](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-12_43_44-Downloads-File-Explorer.png\")
<\/p>\nAudit<\/h2>\n
\n
\n
\n
\n
\n
\n
\n
\n
![\"The](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-15_33_12-.png\")
<\/p>\n\n
\n
\n
\n
\n
![\"Device](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_32_21-Downloads-File-Explorer.png\")
<\/p>\nCopy \/ Paste<\/h3>\n
![\"Copy](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_05_17-.png\")
<\/p>\nSecurity Configuration<\/h2>\n
ActiveID<\/h3>\n
TypingID Rules<\/h3>\n
![\""Create\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-16_55_46-.png\")
<\/p>\nCreate a typingID rule<\/h4>\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Inactivity Lock<\/h3>\n
Scopes and Timers<\/h4>\n
![\""Name\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_17_49-Downloads-File-Explorer.png\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Website Exclusions<\/h4>\n
![\"A](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_24_27-.png\")
<\/p>\nPasskey<\/h4>\n
\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/seurity-checks.png\")
<\/p>\nHow it Works (The User Experience)<\/h4>\n
\n
![\"How](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/check.png\")
<\/p>\nWhat the Admin Controls<\/h4>\n
\n
Anti-Phishing<\/h2>\n
![\""Name\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_34_00-.png\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Allowed Websites \/ Blocked Websites<\/h3>\n
![\""Allowed\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_47_42-.png\")
<\/p>\nAllowed websites<\/h4>\n
\n
example.com<\/code>\u00a0\u2192 Exact domain (also matches\u00a0www.example.com<\/code>)<\/li>\n*.example.com<\/code>\u00a0\u2192 All subdomains (mail.<\/code>,\u00a0app.<\/code>,\u00a0login.<\/code>, etc.)<\/li>\ntrusted-*.com<\/code>\u00a0\u2192 Domains starting with\u00a0trusted-<\/code>\u00a0in\u00a0.com<\/code>\u00a0TLD<\/li>\ncompany-*.net<\/code>\u00a0\u2192 Domains starting with\u00a0company-<\/code>\u00a0in\u00a0.net<\/code>\u00a0TLD<\/li>\n*.google.*<\/code>\u00a0\u2192 All Google domains across all TLDs<\/li>\n<\/ul>\nBlocked websites<\/h4>\n
\n
example.com<\/code> \u2192 Block the entire domain<\/li>\nexample.com\/phishing<\/code>\u00a0\u2192 Block specific page<\/li>\nexample.com\/fake\/*<\/code>\u00a0\u2192 Block all pages under\u00a0\/fake\/<\/code><\/li>\n*.evil.com<\/code>\u00a0\u2192 Block all subdomains of\u00a0evil.com<\/code><\/li>\nphishing-*.net<\/code>\u00a0\u2192 Block domains like\u00a0phishing-bank.net<\/code>,\u00a0phishing-paypal.net<\/code><\/li>\nsite.com\/api\/*\/login<\/code>\u00a0\u2192 Block pattern in path<\/li>\n<\/ul>\n<\/div>\n<\/div>\nDevice Performance – Performance Rules<\/h4>\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-17_56_23-.png\")
<\/p>\nCopy \/ Paste<\/h4>\n
\n
\n
![\""Navigate\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_02_01-Greenshot.png\")
<\/p>\nMonitoring<\/h2>\n
Browser Monitoring<\/h3>\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_16_55-.png\")
<\/p>\nMonitoring Groups<\/h3>\n
![\"Pre-configured](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/06\/2026-06-30-18_20_55-.png\")
<\/p>\nWebhooks & SIEM<\/h2>\n
\n