Risk definitions provide the ability to build custom rules that enhance automated safety and security goals. It's best to create multiple definitions designed to detect a variety of risk types.
This guide covers the key sections of creating a risk scan:
UTILIZING RISK DEFINITIONS
Risk definitions contain unique conditions that act as a building block for admin monitoring end goals. Definitions can help detect content related to bullying, self-harm, threats, sensitive information and more.
CREATING BASIC RISK
The Risk Scanning tab provides options to search, create, test, edit and delete scan definitions.
Click the + Add Risk Definition button in the top-right corner to create a new Risk scan.
Most risk definitions use a standard set of input fields. Scans by Keywords are the simplest and most common method for detection.
Name: Assign identifier to risk scan definition.
Description: Provide a clear overview of risk scan goal.
Keywords: Input comma separated list of words or phrases to flag for risk.
CREATING ADVANCED RISK
The Advanced Settings dropdown refines the definition to flag more accurate results. This is a great way to reduce false positive events. For example, the Keyword "gun" is broad but adding context like "school" or "bring" creates a much more specific alert.
Context
Context Words: Input comma separated list of words or phrases.
Context Check Length: Define proximity between keyword and context word.
Filtering
Allowed Words: Input approved comma separated list of words or phrases.
Allowed Regex: Regular Expressions used for approved complex pattern.
---
Regex: Regular Expressions used for complex pattern matching.
Match Count: Set a risk trigger threshold.
CREATING REUSED RISK
The Re-use Existing Patterns section is leveraged when needing to assign existing definitions into a new risk definition.
Click the Re-use Existing Patterns icon in Advanced Settings to apply multiple scan patterns on a single risk definition.
Existing patterns will be displayed in the search field for selection. A risk match threshold can be set if one occurrence is not concerning but multiple cases in the same source becomes actionable.
Patterns: Apply existing setups into a new single definition.
Match Count: Set a risk trigger threshold.
SETTING SCOPE AND LIMITS
The Scopes and Limits subtab contains user view and directionality options. Sharing Limits and Apply To options restrict scanning to a targeted group of users. Checkbox settings allow for further granularity depending on directionality concerns.
Sharing Limits: Restrict risk scanning to selected views.
Directionality: Restrict risk scanning to selected event types.
Apply To Security Groups/Organizational Units: Restrict risk scanning to selected account groups.