Red Flags and Alerts Guide

Red Flags indicate the category and frequency of potentially risky web content students access. 

Red Flags are triggered when a user: 

• Attempts to access a website or app known to either be inappropriate or contain inappropriate content, such as pornography.
• Attempts to access a tool or service that could be used to bypass filtering.
• Searches for content using keywords or phrases identified as risky.

Use Red Flags as indicators, not to be looked at in isolation but rather to be assessed in conjunction with other indicators when concerned about a user’s wellbeing. You can build a clearer picture of potential intent, to evaluate overall harm or distraction using a combination of reporting tools.

You should investigate the cause of a Red Flag before taking any action with a user. Red Flags indicate potentially risky activity and may sometimes flag content that you might otherwise consider appropriate for the user to view.

Reviewing Red Flags on the Dashboard 

The Red Flags are summarized in your Overview Dashboard. You can click View All or select a specific user’s Red Flag.

1. View All - redirects you to the Red Flags report.
2. Risk Indicator - redirects you to the corresponding Apps and Websites or Searches report for the selected user’s attempted access to this content category with the selected date.

Using the Red Flags Report

You can also navigate to Cyber Safety > Red Flags. 

Here you will see a list of users sorted by default with the largest number of serious Risk Indicators on the top.

For the selected time period:

1. Select filter tag - type part of the category for a tag and select one or more tags to show users with any of these Risk Indicators. Only active Risk Indicators will be available to pick from.
2. Reset Filters - unchecks selected Categories and redisplays all Report data.
3. Search - type part of a student’s Username or Full Name to find their Red Flags data.
4. Username - click the user’s ID to go to their User Report.
5. Full Name - click the user’s name to go to their User Report.
6. Risk Indicators - click one of the color-coded Red Flag tags identifying the frequency of attempted access to inappropriate content to go to the Apps and Websites or Searches detail report for this user’s activity relating to the selected Risk Indicator.
7. Export Report - click to download a CSV (Comma Separated Values) file you can open in a spreadsheet program.

Filtering for Red Flags

You can find users with specific Red Flags by filtering the Risk Indicators.

When you go to Cyber Safety > Red Flags:

Searching for a Student

Alternatively, you can search for a student and view their Red Flags.

Investigating Red Flags

When you view your users’ Red Flags, you may notice a large cluster of Red Flags and become concerned about their behavior. From the Red Flags Report you can investigate the details of when and which websites your user tried to access for each Red Flag. 

Click on a Risk Indicator for an App or Website.

You will see the number of times per day the selected user attempted to access the Red Flag content.

If you click on a date you will go to the Timeline view for the selected user to assess if the student attempted to access the blocked content during or outside of school.

Reviewing a User’s Search History

Linewize Filter allows you to look at the phrases a user entered into their Google searches.

1. Select a filter tag to find a category of Red Flags. Click on one of the user’s Red Flags with a magnifying glass.
2. The User’s Search History will open. Click on a search expression to see the results on Google.
3. Review the Google search results.

   Suggestion

   You can use the search results to discover new slang words and phrases. You can help identify other students who need your support.

4. Click the View in Context link to see the exact date and time of the flagged search in the User Journey Report. The report highlights the Red Flag you are investigating and displays events that occurred within an hour of the Red Flag. You can investigate the student’s website, application and search activity during that period.

If you notice a new search phrase and are concerned the word is a conduit for malicious activity ask your IT support or Filtering Administrator to add a filtering rule to block the phrase.

Exporting Red Flag Data

The two primary options for exporting Red Flags data. Your first option is to download the subtotaled count of categories for the users displayed in your Red Flags Report (see the steps below).

Getting a summary of the categories of activity can help you document an improvement or emerging issue in online behavior among the group of students you support. You can even change the time period and export additional reports to compare the change over time.

The second option is to select a user and download their User Journey Report data. This will help you view the detailed activities and times of the allowed, blocked, and flagged web content a single user was attempting to access.

1. Verify or change the date range for your Red Flags summary report. Click on the calendar at the top of your screen. Select a date range.
   We recommend a minimum of 2 days and a maximum of 2 weeks for most systems. Larger date ranges will take significantly longer to be compiled before you can download the data.

   

2. Verify your Red Flag filters or click Reset Filters to view all users.
3. Click Export Report.
4. A CSV (Comma Separated Values) file will download to your computer. Find the file ending in .CSV and open it in your spreadsheet program.

As desired, format your file, convert text to columns or add notes to your file. Refer to your spreadsheet publisher’s documentation for instructions.  

Receiving Notifications by Email

The "REDFLAG ALERT" is an automated email report to help school leadership and wellbeing staff monitor students who may need to provide immediate intervention. Contact your IT support to set up email notifications for you.

After your "REDFLAG ALERT" email notifications are set up, look for an email from redflags@linewize.com with the subject, “[REDFLAG ALERT]”. You will also see the student’s name and the type of Red Flag in the subject. You will receive one email per Red Flag per student. 

When you open a Red Flag email, you will see:

1. The Student’s name and Linewize Filter device name
2. Click to Go to the user dashboard to see a summary of web traffic, top traffic types, and subtotals of the count of the web content and searches by category. 
3. Time and date of the Red Flag activity
4. Category of the Red Flag
5. When search terms or keywords can be captured, those will be listed in Request under the Red Flag. Click View in Linewize Filter to go to the user’s Search Report.

Combining Your Resources 

You may want to review the time of day and types of content the user is accessing to trigger the email alerts. When you go to the User Dashboard, you can click User Journey to review the content that was allowed, blocked, and flagged for potential risks by the time of day and web address. You can use this information to decide how to support this user.

Another tool to help you investigate the details of the user’s recent activity is on the User’s Dashboard. Click View Timeline to view a list of the time of day, websites, and amount of data sent or received. In the Verdict column, you will see which types of connections were allowed or blocked. Red connections were blocked and green connections were allowed.

You can use the Red Flags report to support your users engaging in potentially risky behavior. Ask your IT support for Red Flags email notifications if you need to respond quickly to a user at immediate risk. Keep a record of your progress with users you are providing guidance to by downloading Red Flags, User Journey and User Timeline data. Overall, the Red Flags report helps you monitor your users' wellbeing.