- \n
- Name<\/strong>\u00a0\u2013 enter the name for the rule\n
- \n
- Default severity \u2013 select severity for the rule\n
- \n
- Unspecified<\/li>\n
- Low<\/li>\n
- Moderate<\/li>\n
- High<\/li>\n
- Critical<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Scope<\/strong>\u00a0\u2013 pick and select the scope for the alert\n
- \n
- Pick user, group, or Org. Unit of users\n
- \n
- Excluded scope \u2013 Specify users, groups, or OUs that should be excluded from the scope of the defined rule.\n
- \n
- Add: excluded scope<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Configuration<\/strong>\u00a0\u2013\u00a0 Confidence level at which ActiveID will send an alert.\n
- \n
- Enter the prediction threshold<\/strong>\u00a0(%) \u2013 add percentile<\/li>\n
- Action on violation<\/strong>\u00a0\u2013 Select one of the user logout actions to be executed when a role is violated:\n
- \n
- None<\/strong> \u2013 No user session action will be taken.<\/li>\n
- Passkey<\/strong> -Locks the screen. Success resumes access; cancel or failure keeps the screen locked.<\/li>\n
- Clear cookies<\/strong> – Clears the user’s browser cookies, signing them out of other web apps. This does not sign the user out of their Google Account.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Notifications<\/strong>\u00a0\u2013 fill in the details\n
- \n
- Alert recipients \u2013 enter alert recipients<\/li>\n
- Webhooks & SIEM \u2013 select option\n
- \n
- Elastic Search<\/li>\n
- Generic receiver<\/li>\n
- Splunk<\/li>\n<\/ul>\n<\/li>\n
- Webcam capture \u2013 select option\n
- \n
- Do not send<\/li>\n
- Send in the notification email<\/li>\n
- Send in the notification email and save to the rule creator\u2019s Drive<\/li>\n
- Send in the notification email, save to the rule creator\u2019s Drive, and share with other alert recipients<\/li>\n<\/ul>\n<\/li>\n
- Screen capture \u2013 select option\n
- \n
- Do not send<\/li>\n
- Send in the notification email<\/li>\n
- Send in the notification email and save to the rule creator\u2019s Drive<\/li>\n
- Send in the notification email, save to the rule creator\u2019s Drive, and share with other alert recipients<\/li>\n<\/ul>\n<\/li>\n
- Attach website name \u2013 enable or disable the option<\/li>\n<\/ul>\n<\/li>\n
- Summary<\/strong>\u00a0\u2013 view all the options that are selected<\/li>\n<\/ul>\n
![\"Navigate](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-22-16_19_51-.png\")
<\/p>\nPasskey \u2013 Credential management<\/h3>\n
View and manage \u201cPasskey\u201d credentials registered by users for identity verification challenges. Admins can see which users have registered credentials, how many credentials they have, and when they were last used. Revoking credentials for a user forces that user to register a Passkey again on their next verification prompt.<\/p>\n
Passkey adds an extra identity check inside the Shield+ browser extension. It is used when the organization wants to make sure the person using the browser is still the correct user.<\/p>\n
How it works for the end-user.<\/p>\n
- \n
- The user is asked to set up a passkey.<\/li>\n
- They can create it on this device, with a phone, or with a hardware security key.<\/li>\n
- When Shield+ needs confirmation, the browser opens a security check screen.<\/li>\n
- The user verifies with their passkey, device PIN, fingerprint, face unlock, phone, or security key.<\/li>\n
- After successful verification, Shield+ returns the user to the page they were using.<\/li>\n<\/ul>\n
Shield+ does not store the user\u2019s password or biometric data. The device keeps the private part of the passkey. GAT\/Shield+ stores the registered credential information needed to check that future passkey responses are valid.<\/p>\n
As an action on a violation, if Passkey is selected, the screen will be locked. Success resumes access; cancel or failure keeps the screen locked.<\/p>\n
The end user will have a pop-up window where they need to set up and use the passkey to log in.<\/p>\n
When Passkey Is Used<\/h3>\n
Passkey can be required in two main situations:<\/p>\n
- \n
- Inactivity Lock<\/b><\/li>\n<\/ul>\n
If the user has been inactive for a configured number of minutes,\u00a0Shield+ locks browsing<\/strong>\u00a0and\u00a0asks for passkey verification before the user can continue.<\/strong><\/p>\n
- \n
- ActiveID Check<\/b><\/li>\n<\/ul>\n
If ActiveID detects unusual typing behavior, an administrator can configure the response to require passkey verification. This helps reduce false positives: instead of immediately treating the activity as unauthorized, the user can prove they are really present.<\/p>\n
There is also an administrator-forced security check path in the extension, but the main user-facing configuration is Inactivity Lock and ActiveID Passkey action.<\/p>\n
![\"The](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-24-15_43_56-Downloads-File-Explorer.png\")
<\/p>\nThe user needs to click on the Start verification<\/strong> button.<\/p>\n
There will be 3 options avaliable.<\/p>\n
- \n
- Create on this device<\/strong><\/li>\n
- Create with phone<\/strong><\/li>\n
- Create with security key<\/strong><\/li>\n<\/ul>\n
Create on this device<\/h4>\n
The user must create and save the password as below.<\/p>\n
- \n
- Can use passkey saved in user’s Google account<\/li>\n
- Windows Hello<\/li>\n<\/ul>\n
![\"Create](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-24-15_54_17-.png\")
<\/p>\nCreate with phone<\/h4>\n
This will generate a barcode that can be scanned with a phone and used to log in.<\/p>\n
Create with security key<\/h4>\n
The user must insert a USB and create it as a security code.<\/p>\n
![\"\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-24-16_14_35-Greenshot.png\")
<\/p>\nUse passkey to log in<\/h3>\n
When the passkey is created. The end-users must use the passkey when the account is logged out<\/strong> by ActiveID checks<\/strong> or by the inactivity lock rule.<\/strong><\/p>\n
![\""<\/p\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-24-16_39_51-.png\")
<\/p>\nClear cookies<\/h4>\n
Clears the user’s browser cookies, signing them out of other web apps. This does not sign the user out of their Google Account.<\/p>\n
Audit TypingID alerts<\/h2>\n
Navigate to Audit > ActiveID > TypingID > Alerts.<\/strong><\/p>\n
You will see all the alerts that are triggered by the TypingID rules set up above.<\/p>\n
View all the details for the alert, such as who triggered the alert and its context.<\/p>\n
![\""Navigate\"](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-22-16_48_36-Greenshot.png\")
<\/p>\nAudit TypingID patterns<\/h3>\n
The raw typing patterns collected from users and processed by the AI models. This view lets admins monitor how actively patterns are being generated per user, which directly reflects how well each user\u2019s identity model is trained.<\/p>\n
- \n
- We collect\u00a02 types of typing patterns<\/strong>. In this section, we present how many typing patterns were verified by our system daily.<\/li>\n
- 1st Type Patterns<\/strong> – Full Typing Pattern \u2013 A detailed profile pattern of your typing style based on 100\u2013150 keystrokes.\n
- \n
- View daily numbers \u2013 for the last 24 hrs<\/li>\n
- View daily average \u2013 for the last 30 days<\/li>\n<\/ul>\n<\/li>\n
- 2nd Type Patterns<\/strong> – Key-Pair Pattern \u2013 A quick profile pattern built from the timing of letter pairs (like \u201cTH\u201d or \u201cAE\u201d)\n
- \n
- View daily numbers \u2013 for the last 24 hrs<\/li>\n
- View daily average \u2013 for the last 30 days<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Navigate to Audit > ActiveID > TypingID > Patterns<\/strong><\/p>\n
![\"The](\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2026\/07\/2026-07-22-17_37_05-.png\")
<\/p>\nScope<\/h4>\n
Admin can select a scope of users and see the stats for the first and second type patterns.<\/p>\n
The scope can be User, Group, OU, or domain-wide.<\/p>\n
Users protected<\/h4>\n
A successfully built model means that the user is being actively protected. AI model checks if the text generated by the user matches the user’s previous typing behaviour.<\/p>\n
Conclusion: Why ActiveID & TypingID Rules Matter for Admins<\/h2>\n
The ActiveID TypingID feature provides continuous, AI-driven behavioral verification to ensure the user behind the keyboard is always the authorized account owner. By evaluating typing dynamics\u2014without recording actual words\u2014admins can automatically detect unauthorized access attempts and take immediate, policy-driven action.<\/p>\n
Key Benefits<\/p>\n
- 1st Type Patterns<\/strong> – Full Typing Pattern \u2013 A detailed profile pattern of your typing style based on 100\u2013150 keystrokes.\n
- We collect\u00a02 types of typing patterns<\/strong>. In this section, we present how many typing patterns were verified by our system daily.<\/li>\n
- Create with phone<\/strong><\/li>\n
- Create on this device<\/strong><\/li>\n
- ActiveID Check<\/b><\/li>\n<\/ul>\n
- Inactivity Lock<\/b><\/li>\n<\/ul>\n
- Passkey<\/strong> -Locks the screen. Success resumes access; cancel or failure keeps the screen locked.<\/li>\n
- Action on violation<\/strong>\u00a0\u2013 Select one of the user logout actions to be executed when a role is violated:\n
- Enter the prediction threshold<\/strong>\u00a0(%) \u2013 add percentile<\/li>\n
- Excluded scope \u2013 Specify users, groups, or OUs that should be excluded from the scope of the defined rule.\n
- Pick user, group, or Org. Unit of users\n
- Default severity \u2013 select severity for the rule\n