This article is for school leadership and wellbeing staff.
What is the difference between the Red Flag Risk Indicators?
Icons and Colors of Risk Indicators
You can identify the frequency and types of risky online activity by the color and clustering of the Red Flags on the Risk Indicators column.
The categories may contain both the content the user was allowed to access, and was blocked from accessing. If you need to see the details of the content a user was blocked from accessing, go to the Blocked Report and select the user you are concerned about.
Red Flag Icons
You can quickly recognize the category of the Risk Indicator by the following icons.
|A Globe means the user has accessed or was trying to access content hosted on websites or web servers.|
|A Gear means the user used or tried to use apps and services, like VPNs that may bypass filtering.|
|A Magnifying Glass will only be displayed with keywords for the search engines your IT support has set up, like Google, Bing, and the YouTube website.|
To capture Bing and Google search terms and YouTube keywords, your IT support needs to enable MITM and HTTPS Inspection.
Red Flag Colors
While we refer to these elements as “Red Flags”, you will notice two other colors in the Risk Indicators. We often refer to the Risk Indicators as Red Flags because these tags appear in the Red Flags reports, dashboard tiles, and columns. The color of the Risk Indicator lets you know how frequently the user attempted to access this category of content for this category of online content.
Red indicates frequent attempts to access potentially risky content or conduct an unsafe search. This user's total number of attempts were greater than 5% of the blocked attempts in this category for all of the users in School Manager.
Users with highest count red indicators will appear at the top of Red Flag lists in your dashboard, report pages, and email reports. Will be associated with the device, website, or search activity.
Pink indicates some consistency in trying to access potentially risky content or conduct an unsafe search. This user's total number of attempts in this category are between 2% and 5% compared to the total attempts in this category for all users.
Users will usually appear in the middle of Red Flag lists when they have only pink and blue indicators.
Blue indicates a user has attempted to access potentially risky content or use unsafe search keywords on a few occasions, typically once or twice within the selected time period.
The total number of attempts in this category are less than 2% of the attempts compared to the all other users. Users usually appear at the bottom of Red Flag lists if they only have blue categories.
Risk Indicator Categories
Overall, you will be able to assess potential threats by reviewing a common set of categories of Risk Indicators:
|Academic Dishonesty||Searches for Artificial Intelligence (AI) text-based generators or AI text-based essay writers.|
|Adult Content||Websites and apps known to host videos, images, and audio of sexual or explicit content|
|Adult Content Search||Keywords, slang or code words associated with sexual or explicit content|
|Bullying||Online activities causing psychological harm by repeated aggressive actions like teasing, shaming, rejecting or criticizing a person, especially on social media or within a social group|
|Depression||Negative feelings interfering with healthy social and mental interactions|
|Devices||An excessive number of devices are logged on with a student’s account, which may indicate a user sharing their login information with other users|
|Hate Speech||Threatening or abusive activities directed at traits and labels associated with groups of people|
|Offensive Content||Inappropriate topics such as vulgar and explicit language, images, video or audio that does not fit standard categories like Adult Content or Hate Speech|
|Substance Abuse||Tobacco, alcohol, and drugs, including behaviors associated with addiction|
|Suicide||Ending one’s life which may include self-harm and associated behaviors|
|Violence||Planning or threatening harm, death or damage to people, property or objects of emotional or financial value|
|VPN||Apps and services used to hide online activity, anonymize a user's identity on a safe network, and bypass filtering|
For more information, see School Manager Red Flags and Alerts Guide.
Frequently Asked Questions
Can a Risk Indicator be a false positive?
Risk indicators are sometimes false positives. A Red Flag doesn't always indicate a student's intentions. They sometimes show that they have attempted to access restricted or protected content, or used risky search terms by mistake. It is also common for students to reach a website that contains embedded links or advertisements that are blocked.
As a result, Linewize recommends that in addition to investigating individual risk indicators, Wellbeing staff should also look at risk indicators over a period of time. This will help identify students who are persistently performing risky searches when compared to their peers, and will also lessen the impact of false positives.
How can I further investigate a student’s Red Flag activity?
- Go to Statistics > Dashboard.
- Hover over the Red Flag to quickly see the number of red flags and when each hit was recorded.
- Select a student's username within the Red Flag section to see more information.
- Select View in Context to see the exact date and time of the flagged search in the User Journey Report. You can compare the highlighted Red Flag to other events in the User Journey Report.
Here, you can see a lot of information about the student’s online activity. To find out more about a Red Flag Search, select one of the search results:
Here, you can see a student's Red Flags for risky search terms:
Allowed and Blocked Content
What information can I get from the Apps and Websites page?
The Apps and Websites page will show you what content students are accessing at school. The page shows the Category, Website and amount of Data used. You can sort the list by column headings in ascending or descending order.
How can I see what videos are trending at my school?
To see trending videos at your school, navigate to Cyber Safety > Videos. If you can’t see the videos, contact your IT support to enable MITM and HTTPS Inspection.
To watch the video or see the users who have watched the video, select the Video’s Title from the list.
It is important to identify any potentially harmful video content that has gone viral. Examples include the Momo Challenge or the TikTok suicide.
If harmful video content has been viewed by students, you can offer support to those students. For more information, read the Creating and Using the Video Report guide.
How can I use Activity and Compliance to conduct a peer comparison?
Some schools choose to enable the Activity and Compliance reports to compare the expected types of content with their users' actual content types. Setting the content expectations tends to be most useful for the younger K-6 years, but often cannot fit the variety of learning levels as middle school and high school students diversify their studies.
The Activity and Compliance Report provides an overview of users' compliance to expected network use and compares data between expected and actual traffic to websites, applications, and search engines.
To view the Activity and Compliance Report:
- Go to Cyber Safety > Activity and Compliance.
- Using the dropdown on the top right, you can select the cohort to compare. This will show the Expected vs Actual use of the cohort.
- Enter the Expected data manually (by a School Manager Administrator) by content category as a percentage
For example, Google Search 50%, Streaming Media 25%, Education 25%. The total categories must add up to 100%. This would typically be done in consultation with teaching staff who are aware of the kinds of content students need to access.
If you don’t see the dropdown, speak to your IT support to set the Groups. Typically, this would list each year group individually.
Users with the higher percentages indicate that they are closest to the expected usage. Students with the lowest percentage show the students who may be not as compliant. For more information, read the Activity and Compliance Guide.
What is the Blocked Content report?
The Blocked Content report shows the top restricted content by percentage that users have attempted to access against specific categories and signatures. The content that is blocked is based upon the Block filtering policies your school has created in School Manager.
- Selecting View All will provide a list view of all websites that have been blocked.
- To view the specific Users, Apps or Policies, navigate to Cyber Safety > Blocked.
For more information and a printable guide, see the Cyber Safety Interface Guide.
How can I tell if a student has tried to search for inappropriate content?
The Word Cloud search feature can help you to see what words your students are searching for. This is a graphical representation of the number of times a word has been searched for. The bigger and bolder the word appears, the more often the word has been searched for.
- To use the Word Cloud Search feature, navigate Cyber Safety > Searches
If you can’t see the Word Cloud, contact your school's IT support to enable MITM and HTTPS Inspection for you.
You can also select Filter Tags using the dropdown. The tags include Violence, Hate Speech, Bullying, Depression, Substance Abuse and Adult Content.
The content may be words that appear when Filter Tags are active may be confronting and sensitive. View the web pages with discretion.
Another option to look at which student has tried to search for inappropriate content is to use the Red Flags search feature.
Attempts to Bypass Filtering
How is student Virtual Private Network (VPN) activity relevant to me?
A Virtual Private Network (VPN) allows the user to hide their identity and access content in different locations. While VPNs have a number of legitimate purposes, they are commonly used by students to attempt to circumvent school internet filtering.
If you find students are consistently using or trying to use VPNs in a school environment, it is likely that they are actively trying to bypass your school's content filtering policies and in doing so impacting the school’s ability to meet its duty of care.
How can I find out if there is VPN activity within the school?
There are a couple of ways to determine if a student is trying to use a VPN.
- Navigate to Cyber Safety > Red Flags.
If you see a VPN icon in this column, it means School Manager has detected a VPN or behavior that could mean the student is using a VPN.
- Navigate to Cyber Safety > Blocked > Policies.
If you have a Block VPNs filtering policy set up, you can see the number of violations.
- Select the Block VPNs policy to see the individual users and the number of attempts to access VPNs.
How can I identify users attempting to "hot spot" at the school?
The best way to identify a potential student hot spotter is to compare the individual student activity against a cohort over the last 30 days.
- Navigate to Statistics > Active Users.
- Look at the average amount of data the students have used in the last 30 days to get a baseline data usage, then sort by the lowest in the Transfer Column.
- Low or no activity may indicate potential hot spotting, especially if you know that a student has been present at school.
How can I use reporting in School Manager?
Alerts and reports can be tailored to suit your requirements. It’s a good way to monitor the risk indicators triggered by users or groups.
- Periodic reports provide you with weekly insights into the students' online activities.
Alerts once configured will provide immediate email notifications, allowing Pastoral Care staff to take the necessary steps/intervene immediately, as needed.
For Example, a student using Google to search for self-harm (where a “Suicide Search” alert has been configured) will prompt an immediate alert to the staff member recipient. In this case, the Pastoral Care team member would take action based on the school’s pre-determined internal process in order to ensure the wellbeing/safety of the student.
The most common reports that Pastoral Care/Wellbeing staff use are the Weekly Reports, Weekly Wellbeing Reports, and Red Flags Report. For more information, read the Reports and Alerts Guide.
Why is it important to use the date/time range in School Manager?
Using the date/time range is important to give you the correct scale perspective relating to online activity.
- Short ranges are best used for forensics in a particular incident. For example, you might want to see the data usage of a specific user in the last 7 days.
- Longer ranges are best used to see trends or patterns of behavior. For example, you might want to see the most popular videos in the last 30 days.
Which reports can you save?
You can export the following reports to save the data in a spreadsheet format.
- User Journey Report
- Red Flags
- Top Blocked Users
- Apps & Websites
- Users & Hosts
Share this information with your staff. Download and print our Cyber Safety Quick Reference Guide.
Please sign in to leave a comment.