This article is for school leadership and wellbeing staff.
Icons and Colors of Risk Indicators
You can identify the frequency and types of risky online activity by the color and clustering of the Red Flags on the Risk Indicators column.
The categories may contain both the content the user was allowed to access, and was blocked from accessing. If you need to see the details of the content a user was blocked from accessing, go to the Blocked Report and select the user you are concerned about.
You can quickly recognize the category of the Risk Indicator by the following icons.
|A Globe means the user has accessed or was trying to access content hosted on websites or web servers.|
|A Gear means the user used or tried to use apps and services, like VPNs that may bypass filtering.|
|A Magnifying Glass will only be displayed with keywords for the search engines your IT support has set up, like Google, Bing, and the YouTube website.|
Red Flag Colors
While we refer to these elements as “Red Flags”, you will notice two other colors in the Risk Indicators. We often refer to the Risk Indicators as Red Flags because these tags appear in the Red Flags reports, dashboard tiles, and columns. The color of the Risk Indicator lets you know how frequently the user attempted to access this category of content for this category of online content.
Red indicates frequent attempts to access potentially risky content or conduct an unsafe search. This user's total number of attempts were greater than 5% of the blocked attempts in this category for all of the users in School Manager.
Users with highest count red indicators will appear at the top of Red Flag lists in your dashboard, report pages, and email reports. Will be associated with the device, website, or search activity.
Pink indicates some consistency in trying to access potentially risky content or conduct an unsafe search. This user's total number of attempts in this category are between 2% and 5% compared to the total attempts in this category for all users.
Users will usually appear in the middle of Red Flag lists when they have only pink and blue indicators.
Blue indicates a user has attempted to access potentially risky content or use unsafe search keywords on a few occasions, typically once or twice within the selected time period.
The total number of attempts in this category are less than 2% of the attempts compared to all other users. Users usually appear at the bottom of Red Flag lists if they only have blue categories.
Overall, you will be able to assess potential threats by reviewing a common set of categories of Risk Indicators:
|Academic Dishonesty||Searches for Artificial Intelligence (AI) text-based generators or AI text-based essay writers.|
|Adult Content||Websites and apps known to host videos, images, and audio of sexual or explicit content|
|Adult Content Search||Keywords, slang or code words associated with sexual or explicit content|
|Bullying||Online activities causing psychological harm by repeated aggressive actions like teasing, shaming, rejecting or criticizing a person, especially on social media or within a social group|
|Depression||Negative feelings interfering with healthy social and mental interactions|
|Devices||An excessive number of devices are logged on with a student’s account, which may indicate a user sharing their login information with other users|
|Hate Speech||Threatening or abusive activities directed at traits and labels associated with groups of people|
|Offensive Content||Inappropriate topics such as vulgar and explicit language, images, video or audio that does not fit standard categories like Adult Content or Hate Speech|
|Substance Abuse||Tobacco, alcohol, and drugs, including behaviors associated with addiction|
|Suicide||Ending one’s life which may include self-harm and associated behaviors|
|Violence||Planning or threatening harm, death or damage to people, property or objects of emotional or financial value|
|VPN||Apps and services used to hide online activity, anonymize a user's identity on a safe network, and bypass filtering|
For more information, see School Manager Red Flags and Alerts Guide.
Frequently Asked Questions
Can a Risk Indicator be a false positive?
Risk indicators are sometimes false positives. A Red Flag doesn't always indicate a student's intentions. They sometimes show that they have attempted to access restricted or protected content, or used risky search terms by mistake. It is also common for students to reach a website that contains embedded links or advertisements that are blocked.
As a result, Linewize recommends that in addition to investigating individual risk indicators, Wellbeing staff should also look at risk indicators over a period of time. This will help identify students who are persistently performing risky searches when compared to their peers, and will also lessen the impact of false positives.
- Go to Statistics > Dashboard.
- Hover over the Red Flag to quickly see the number of red flags and when each hit was recorded.
- Select a student's username within the Red Flag section to see more information.
- Select View in Context to see the exact date and time of the flagged search in the User Journey Report. You can compare the highlighted Red Flag to other events in the User Journey Report.
Here, you can see a lot of information about the student’s online activity. To find out more about a Red Flag Search, select one of the search results:
Here, you can see a student's Red Flags for risky search terms:
Allowed and Blocked Content
The Apps and Websites page will show you what content students are accessing at school. The page shows the Category, Website and amount of Data used. You can sort the list by column headings in ascending or descending order.
To watch the video or see the users who have watched the video, select the video’s title from the list.
It is important to identify any potentially harmful video content that has gone viral. Examples include the Momo Challenge or the TikTok suicide.
If harmful video content has been viewed by students, you can offer support to those students. For more information, read the Creating and Using the Video Report guide.
The Blocked Content report shows the top restricted content by percentage that users have attempted to access against specific categories and signatures. The content that is blocked is based upon the Block filtering policies your school has created in School Manager.
- Selecting View All will provide a list view of all websites that have been blocked.
- To view the specific Users, Apps or Policies, navigate to Cyber Safety > Blocked.
For more information and a printable guide, see the Cyber Safety Interface Guide.
The Word Cloud search feature can help you to see what words your students are searching for. This is a graphical representation of the number of times a word has been searched for. The bigger and bolder the word appears, the more often the word has been searched for.
- To use the Word Cloud Search feature, navigate Cyber Safety > Searches
You can also select Filter Tags using the dropdown. The tags include Violence, Hate Speech, Bullying, Depression, Substance Abuse and Adult Content.
The content may be words that appear when Filter Tags are active may be confronting and sensitive. View the web pages with discretion.
Another option to look at which student has tried to search for inappropriate content is to use the Red Flags search feature.
Attempts to Bypass Filtering
A Virtual Private Network (VPN) allows the user to hide their identity and access content in different locations. While VPNs have a number of legitimate purposes, they are commonly used by students to attempt to circumvent school internet filtering.
If you find students are consistently using or trying to use VPNs in a school environment, it is likely that they are actively trying to bypass your school's content filtering policies and in doing so impacting the school’s ability to meet its duty of care.
How can I find out if there is VPN activity within the school?
There are a couple of ways to determine if a student is trying to use a VPN.
- Navigate to Cyber Safety > Red Flags.
If you see a VPN icon in this column, it means School Manager has detected a VPN or behavior that could mean the student is using a VPN.
- Navigate to Cyber Safety > Blocked > Policies.
If you have a Block VPNs filtering policy set up, you can see the number of violations.
- Select the Block VPNs policy to see the individual users and the number of attempts to access VPNs.
The best way to identify a potential student hot spotter is to compare the individual student activity against a cohort over the last 30 days.
- Navigate to Statistics > Active Users.
- Look at the average amount of data the students have used in the last 30 days to get a baseline data usage, then sort by the lowest in the Transfer Column.
- Low or no activity may indicate potential hot-spotting, especially if you know that a student has been present at school.
Alerts and reports can be tailored to suit your requirements. It’s a good way to monitor the risk indicators triggered by users or groups.
- Periodic reports provide you with weekly insights into the students' online activities.
Alerts once configured will provide immediate email notifications, allowing Pastoral Care staff to take the necessary steps/intervene immediately, as needed.
For Example, a student using Google to search for self-harm (where a “Suicide Search” alert has been configured) will prompt an immediate alert to the staff member recipient. In this case, the Pastoral Care team member would take action based on the school’s pre-determined internal process in order to ensure the wellbeing/safety of the student.
The most common reports that Pastoral Care/Wellbeing staff use are the Weekly Reports, Weekly Wellbeing Reports, and Red Flags Report. For more information, read the Reports and Alerts Guide.
Using the date/time range is important to give you the correct scale perspective relating to online activity.
- Short ranges are best used for forensics in a particular incident. For example, you might want to see the data usage of a specific user in the last 7 days.
- Longer ranges are best used to see trends or patterns of behavior. For example, you might want to see the most popular videos in the last 30 days.
You can export the following reports to save the data in a spreadsheet format.
- User Journey Report
- Red Flags
- Top Blocked Users
- Apps & Websites
- Users & Hosts
Share this information with your staff. Download and print our Cyber Safety Quick Reference Guide.