Detection configuration

Detection settings define what browser activity triggers a policy. At minimum, every policy requires an Activity type and a Detection Query.

Activity types

Select the type of browser activity to detect. You can select multiple activity types for a single policy.

Extension activities

Activity	Description
Extension Installed	Detects a browser extension being installed
Extension Enabled	Detects when an already-installed extension is enabled

Page activities

Activity	Description
Page Visit	Detects a user visiting a web page
Upload	Detects when a file is being uploaded to a web page
Download	Detects when a file is being downloaded

Input activities

Activity	Description
Input	Detects a user providing input to a web page
Credential Use	Detects input to credential fields (email, username, password)
Copy	Detects a user copying text from a web page
Paste	Detects a user pasting text into a web page

API activities

Activity	Description
Fetch	Detects when a web resource is requested via the Fetch API

Employee actions

Activity	Description
Request	Detects when an employee requests access to a location
Report	Detects when an employee reports a web location as suspicious

Detection query

The Detection Query specifies the exact conditions that must be met for the policy to trigger. It uses a query syntax similar to Elasticsearch/Lucene.

Query structure

A query consists of one or more filters joined by AND or OR operators.

Filter format:

[NOT] field:value

Examples:

location:"drive.google.com"
NOT location:"drive.google.com"
domain:"*.example.com"
category:"social_media"

Common fields

Field	Description	Example
location	Full URL of the page	location:"https://example.com/login"
domain	Domain of the page	domain:"example.com"
category	Site category	category:"social_media"
lists	Custom list reference	lists:"blocked_sites"
upload.files.name	Uploaded filename	upload.files.name:"*.xlsx"
download.files.name	Downloaded filename	download.files.name:"*.exe"
input.type	Type of input field	input.type:"password"

Multiple filters

Combine filters with AND or OR:

# Block uploads to non-approved sites
NOT location:"drive.google.com" AND NOT lists:"approved_upload_sites"

# Detect credential use on suspicious pages
input.type:"password" AND (category:"uncategorized" OR category:"newly_registered")

Using the query builder

The Query Builder provides a visual interface for creating detection queries:

1. Click Open Query Builder next to the Detection Query field
2. Add filters using the dropdowns and input fields
3. Toggle filters on/off to include/exclude (adds NOT prefix)
4. Set AND/OR logic between filters
5. The query is automatically generated and synced

You can switch between the Query Builder and raw query view at any time.

Activity query

For input-related activities (Input, Credential Use, Copy, Paste), you can add an Activity Query to filter on specific input properties.

Activity Query fields:

• input.type — Type of input field (text, password, email, etc.)
• input.value — The input content (use with caution for privacy)
• input.sensitive — Whether the input contains sensitive data

Example:

input.type:"password"

This would only trigger for password field inputs, even if the main Detection Query matches.

Priority

Priority determines which policy's safeguard is applied when multiple policies match the same event.

Priority	Level	Use Case
5	Highest	Critical threats requiring immediate blocking
4	High	High-risk activities
3	Medium	Standard policy enforcement
2	Low	Informational policies
1	Lowest	Logging-only policies

Evaluation logic:

1. Policies are evaluated in descending priority order
2. The first matching policy's safeguard is applied
3. A lower-priority policy with a more restrictive safeguard may override
4. Policies with Suppress enabled prevent lower-priority matches

Severity

Severity indicates the risk level of activities matching this policy. Used for reporting, dashboards, and alerting.

Severity	Level	Description
5	Critical	Immediate security threat
4	High	Significant risk requiring attention
3	Medium	Moderate risk or policy violation
2	Low	Minor risk or informational
1	Minimal	Logging or audit purposes

Cooldown

Cooldown limits how frequently a policy can trigger for the same user/activity. Specified in seconds.

Use cases:

• Prevent alert fatigue from repeated triggers
• Reduce integration volume for high-frequency events
• Allow users to retry after acknowledging a safeguard

Example: A 300-second (5-minute) cooldown means the policy won't trigger again for the same user for 5 minutes after the initial trigger.

Short description

The Short field defines the description shown in the console and logs for events matching this policy.

You can include event properties as variables:

• {user} — The user who triggered the event
• {location} — The URL of the page
• {domain} — The domain of the page
• {upload.files.name} — Uploaded file names
• {download.files.name} — Downloaded file names

Example:

{user} uploaded sensitive file to {domain}

Example configurations

Block phishing pages

Activity: Page Visit
Query: category:"phishing" OR lists:"known_phishing_sites"
Priority: 5
Severity: 5

Detect uploads to personal storage

Activity: Upload
Query: lists:"personal_cloud_storage" AND NOT lists:"approved_upload_sites"
Priority: 3
Severity: 3

Monitor credential use on uncategorized sites

Activity: Credential Use
Query: category:"uncategorized"
Activity Query: input.type:"password"
Priority: 2
Severity: 2

Block executable downloads

Activity: Download
Query: download.files.name:"*.exe" OR download.files.name:"*.msi"
Priority: 4
Severity: 4