Wellbeing and Pastoral Carer FAQ – Linewize Filter

This article is for school leadership and wellbeing staff.

What is the difference between the Red Flag Risk Indicators?

Icons and Colors of Risk Indicators

You can identify the frequency and types of risky online activity by the color and clustering of the Red Flags in the Risk Indicators column.

The categories may contain both the content the user was allowed to access and was blocked from accessing. If you need to see the details of the content a user was blocked from accessing, go to the Blocked Report and select the user you are concerned about.

Red Flag Icons

You can quickly recognize the category of the Risk Indicator by the following icons.

	A Globe means the user has accessed or was trying to access content hosted on websites or web servers.
	A Gear means the user used or tried to use apps and services, like VPNs that may bypass filtering.
	A Magnifying Glass will only be displayed with keywords for the search engines your IT support has set up, like Google, Bing, and the YouTube website.

Red Flag Colors

While we refer to these elements as “Red Flags”, you will notice two other colors in the Risk Indicators. We often refer to the Risk Indicators as Red Flags because these tags appear in the Red Flags reports, dashboard tiles, and columns. The color of the Risk Indicator lets you know how frequently the user attempted to access this category of content for this category of online content.

Red indicates frequent attempts to access potentially risky content or conduct an unsafe search. This user's total number of attempts was greater than 5% of the blocked attempts in this category for all of the users in Linewize Filter.

Users with the highest count of red indicators will appear at the top of Red Flag lists in your dashboard, report pages, and email reports. It will be associated with the device, website, or search activity.

Pink indicates some consistency in trying to access potentially risky content or conduct an unsafe search. This user's total number of attempts in this category is between 2% and 5% compared to the total attempts in this category for all users.

Users will usually appear in the middle of Red Flag lists when they have only pink and blue indicators.

Blue indicates a user has attempted to access potentially risky content or use unsafe search keywords on a few occasions, typically once or twice within the selected time period.

The total number of attempts in this category is less than 2% of the attempts compared to all other users. Users usually appear at the bottom of Red Flag lists if they only have blue categories.

Risk Indicator Categories

Overall, you will be able to assess potential threats by reviewing a common set of categories of Risk Indicators:

Academic Dishonesty	Searches for Artificial Intelligence (AI) text-based generators or AI text-based essay writers.
Adult Content	Websites and apps known to host videos, images, and audio of sexual or explicit content
Adult Content Search	Keywords, slang, or code words associated with sexual or explicit content
Bullying	Online activities causing psychological harm by repeated aggressive actions like teasing, shaming, rejecting, or criticizing a person, especially on social media or within a social group
Depression	Negative feelings interfering with healthy social and mental interactions
Devices	An excessive number of devices are logged on with a student’s account, which may indicate a user sharing their login information with other users
Hate Speech	Threatening or abusive activities directed at traits and labels associated with groups of people
Offensive Content	Inappropriate topics such as vulgar and explicit language, images, video, or audio that does not fit standard categories like Adult Content or Hate Speech
Substance Abuse	Tobacco, alcohol, and drugs, including behaviors associated with addiction
Suicide	Ending one’s life which may include self-harm and associated behaviors
Violence	Planning or threatening harm, death, or damage to people, property, or objects of emotional or financial value
VPN	Apps and services used to hide online activity, anonymize a user's identity on a safe network, and bypass filtering

Tip

For more information, see Linewize Filter Red Flags and Alerts Guide.

Frequently Asked Questions

Can a Risk Indicator be a false positive?

Risk indicators are sometimes false positives. A Red Flag doesn't always indicate a student's intentions. They sometimes show that they have attempted to access restricted or protected content or used risky search terms by mistake. It is also common for students to reach a website containing embedded links or blocked advertisements.

As a result, Linewize recommends that in addition to investigating individual risk indicators, Wellbeing staff should also look at risk indicators over a period of time. This will help identify students who are persistently performing risky searches when compared to their peers and will also lessen the impact of false positives.

How can I further investigate a student’s Red Flag activity?

Go to Statistics > Dashboard.
Hover over the Red Flag to quickly see the number of red flags and when each hit was recorded.
Select a student's username within the Red Flag section to see more information.
Select View in Context to see the exact date and time of the flagged search in the User Journey Report. You can compare the highlighted Red Flag to other events in the User Journey Report.

Here, you can see a lot of information about the student’s online activity. To find out more about a Red Flag Search, select one of the search results:

Here, you can see a student's Red Flags for risky search terms:

Allowed and Blocked Content

What information can I get from the Apps and Websites page?

The Apps and Websites page will show you what content students are accessing at school. The page shows the Category, Website, and amount of Data used. You can sort the list by column headings in ascending or descending order.

How can I see what videos are trending at my school?

To watch the video or see the users who have watched the video, select the video’s title from the list.

Identifying any potentially harmful video content that has gone viral is important. Examples include the Momo Challenge or the TikTok suicide.

Tip

If students have viewed harmful video content, you can offer support to those students. For more information, read the Creating and Using the Video Report guide.

What is the Blocked Content report?

The Blocked Content report shows the top restricted content by the percentage that users have attempted to access against specific categories and signatures. The blocked content is based upon the Block filtering policies your school has created in Linewize Filter.

Selecting View All will provide a list view of all websites that have been blocked.
To view the specific Users, Apps, or Policies, navigate to Cyber Safety > Blocked.

Tip

For more information and a printable guide, see the Cyber Safety Interface Guide.

How can I tell if a student has tried to search for inappropriate content?

The Word Cloud search feature can help you to see what words your students are searching for. This is a graphical representation of the number of times a word has been searched for. The bigger and bolder the word appears, the more often the word has been searched for.

To use the Word Cloud Search feature, navigate Cyber Safety > Searches

You can also select Filter Tags using the dropdown. The tags include Violence, Hate Speech, Bullying, Depression, Substance Abuse, and Adult Content.

Caution

The content may be words that appear when Filter Tags are active may be confronting and sensitive. View the web pages with discretion.

Another option to look at when a student has tried to search for inappropriate content is to use the Red Flags search feature.

Attempts to Bypass Filtering

How is student Virtual Private Network (VPN) activity relevant to me?

A Virtual Private Network (VPN) allows users to hide their identity and access content in different locations. While VPNs have several legitimate purposes, they are commonly used by students to attempt to circumvent school internet filtering.

If you find students are consistently using or trying to use VPNs in a school environment, likely, they are actively trying to bypass your school's content filtering policies and, in doing so, impacting the school’s ability to meet its duty of care.

How can I find out if there is VPN activity within the school?

There are several ways to determine if a student is trying to use a VPN.

Navigate to Cyber Safety > Red Flags.
If you see a VPN icon in this column, it means Linewize Filter has detected a VPN or behavior that could mean the student is using a VPN.
Navigate to Cyber Safety > Blocked > Policies.
If you have a Block VPNs filtering policy set up, you can see the number of violations.
Select the Block VPNs policy to see the individual users and the number of attempts to access VPNs.

How can I identify users attempting to "hot spot" at the school?

The best way to identify a potential student hot spotter is to compare the individual student activity against a cohort over the last 30 days.

Navigate to Statistics > Active Users.
Look at the average amount of data the students have used in the last 30 days to get a baseline data usage, then sort by the lowest in the Transfer Column.
Low or no activity may indicate potential hot-spotting, especially if you know that a student has been present at school.

Reporting Tips

How can I use reporting in Linewize Filter?

Alerts and reports can be tailored to suit your requirements. It’s a good way to monitor the risk indicators triggered by users or groups.

Periodic reports provide you with weekly insights into the students' online activities.
Alerts, once configured, will provide immediate email notifications, allowing Pastoral Care staff to take the necessary steps/intervene immediately, as needed.

For Example, a student using Google to search for self-harm (where a “Suicide Search” alert has been configured) will prompt an immediate alert to the staff member recipient. In this case, the Pastoral Care team member would take action based on the school’s pre-determined internal process to ensure the wellbeing/safety of the student.

Tip

Pastoral Care/Wellbeing staff use the most common reports are the Weekly Reports, Weekly Wellbeing Reports, and Red Flags Report. For more information, read the Reports and Alerts Guide.

Why is it important to use the date/time range in Linewize Filter?

Using the date/time range is important to give you the correct scale perspective of online activity.

Short ranges are best used for forensics in a particular incident. For example, you might want to see the data usage of a specific user in the last seven days.
Longer ranges are best used to see trends or patterns of behavior. For example, you might want to see the most popular videos in the last 30 days.

Which reports can you save?

You can export the following reports to save the data in a spreadsheet format.