Elevating the Mac Experience: Parity and Performance<\/strong><\/h1>\n\n\n\nTo address the complexities of today\u2019s heterogeneous IT landscapes, we have substantially enhanced our macOS feature set. This release provides Mac users with a robust array of security and monitoring capabilities that achieve closer functional parity with our Windows monitoring capabilities.<\/p>\n\n\n\n
Monitoring ChatGPT Web Interactions<\/strong><\/h2>\n\n\n\nThe Mac Agent now supports full monitoring of ChatGPT Web<\/strong> sessions. This feature tracks all user prompts, the corresponding AI-generated outputs, and attachment uploads. This is a critical addition for organizations looking to audit how generative AI is being used while ensuring sensitive company data isn’t being shared with public models. All data is surfaced in the LLM<\/strong> BI Report.<\/p>\n\n\n\n![\"Monitoring](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Monitoring-ChatGPT-Web-Interactions.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nTracking AI Mode in Google Search<\/strong><\/h2>\n\n\n\nWe have added support for tracking the AI Mode<\/strong> feature within Google Search on Mac. This ensures that chat interactions and file uploads within Google\u2019s AI ecosystem are captured. Like our ChatGPT monitoring, these interactions are logged in the LLM<\/strong> BI Report, providing a centralized view of AI tool usage for compliance and productivity tracking.<\/p>\n\n\n\n![\"Tracking](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Tracking-AI-Mode-in-Google-Search.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nMonitoring and Rules Support for Google Drive Web Uploads<\/strong><\/h2>\n\n\n\nThe Mac Agent now tracks file uploads to Google Drive<\/strong> across all major browsers which can be viewed under the Web File Events<\/strong> BI Report. Furthermore, you can now create Files Activity <\/strong>rules specifically for these uploads. By using criteria such as File Operation, Upload URL, or File Name, you can enforce policies or trigger alerts the moment a file is moved to this popular cloud repository.<\/p>\n\n\n\n![\"Monitoring](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Monitoring-and-Rules-Support-for-Google-Drive-Web-Uploads.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nOptimized Evidence Collection with Record on Rule Violation Only<\/strong><\/h2>\n\n\n\nTo help organizations balance comprehensive evidence collection with storage efficiency, we\u2019ve enabled support for the RECORD ONLY WHEN BEHAVIOR RULE WAS VIOLATED<\/strong> option on Mac. When enabled, it will force the Agent to capture video only when a specific rule is triggered with the RECORD VIDEO<\/strong> action. This reduces storage needs, enhances user privacy, and ensures that security analysts only see the relevant “smoking gun” footage without the filler of routine daily activity.<\/p>\n\n\n\n![\"Optimized](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Optimized-Evidence-Collection-with-Record-on-Rule-Violation-Only.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nSupport for Shared Lists in Email Rules<\/strong><\/h2>\n\n\n\nEmails <\/strong>Activity rules on Mac now fully support Shared Lists<\/strong> in the To, CC, and From fields. This update allows you to quickly apply rules to multiple email recipients or senders and reuse the same list across different rules without manual duplication. Currently, this supports Gmail (web) and Outlook (web).<\/p>\n\n\n\n![\"Support](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Support-for-Shared-Lists-in-Email-Rules.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nPalo Alto GlobalProtect VPN Compatibility<\/strong><\/h2>\n\n\n\nWe\u2019ve improved the Mac Agent to better support environments that use Palo Alto Networks GlobalProtect <\/strong>VPN for all network access to perform SSL inspection \/ certificate injection on web traffic. The Agent now includes several configuration parameters that can be used to keep network monitoring working correctly when traffic is forced through the VPN.<\/p>\n\n\n\n![\"Palo](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/image-17.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nExpanding Windows Monitoring and Compliance<\/strong><\/h1>\n\n\n\nThis release expands Windows monitoring to WhatsApp desktop app, allows process name obfuscation and supports deployment in specialized security environments.<\/p>\n\n\n\n
IM Monitoring for WhatsApp Desktop<\/strong><\/h2>\n\n\n\nWe have expanded our Instant Message\/IM <\/strong>monitoring and behavior rules to include the WhatsApp Desktop<\/strong> app. This update extends visibility beyond the browser, complementing our existing WhatsApp Web coverage to provide deeper oversight into employee communications and enforce automated rules, such as detecting insider risks or preventing data exfiltration.<\/p>\n\n\n\n\n![\"IM](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/IM-Monitoring-for-WhatsApp-Desktop.png\" "\\"\\"")
<\/a><\/figure>\n<\/blockquote>\n\n\n\nCustom Stealth Parameters for Clipboard Monitoring<\/strong><\/h2>\n\n\n\nThe new TMCLIPMONEXE<\/code> <\/strong>installation parameter allows you to rename the clipboard monitor service of the Stealth Agent. By replacing the default process name with a custom name, you can obfuscate the process according to your internal security preferences and naming conventions.<\/p>\n\n\n\n![\"Custom](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/image-18.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nSupport for STIG Compliance<\/strong><\/h2>\n\n\n\nWe\u2019ve introduced support for STIG environments on Edge and Chrome browsers. This is achieved by enhancing how the Agent handles certificate revocation requests. The generated certificates now include all necessary revocation info, ensuring secure web accessibility while maintaining continuous monitoring in STIG-compliant environments.<\/p>\n\n\n\n
Enhanced Alerting and Triage<\/strong><\/h1>\n\n\n\nSecurity analysts shouldn’t have to hunt for evidence. We\u2019ve introduced several features designed to reduce the “time to truth” during investigations and provide immediate context for every alert.<\/p>\n\n\n\n
Link to Evidence Records with Session Player URLs<\/strong><\/h2>\n\n\n\nWe have added a Session Player Url<\/strong> column to the Behavior Alerts report and API. This allows you to jump directly from an alert, whether you are viewing it in Teramind or an external SIEM\/SOAR tool – to the exact moment of the violation in the session recording. This eliminates the need to manually search for sessions or scrub through long videos.<\/p>\n\n\n\n![\"Link](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Link-to-Evidence-Records-with-Session-Player-URLs.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nImproved Context with Locked Sessions Labels in Behavior Alerts<\/strong><\/h2>\n\n\n\nBehavior Alerts<\/strong> descriptions now provide clearer context for violations that occur while a device is locked. Alerts triggered during these times will now be marked with a \u201c(Locked Session)\u201d<\/strong> label. This helps analysts quickly distinguish between background system processes and active user risk, improving the signal-to-noise ratio in investigations.<\/p>\n\n\n\n![\"Improved](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Improved-Context-with-Locked-Sessions-Labels-in-Behavior-Alerts.png\" "\\"\\"")
<\/a><\/figure>\n\n\n\nSeamless Directory Integration<\/strong><\/h1>\n\n\n\nMaintaining a “single source of truth” for employee data shouldn’t be a manual chore. We’ve overhauled how Teramind interacts with your Active Directory integration to ensure data integrity across your organization.<\/p>\n\n\n\n
Flexible Mapping for Imported LDAP Attributes<\/strong><\/h2>\n\n\n\nOur AD\/LDAP integration is now significantly more granular. The new MAP IMPORTED ATTRIBUTES<\/strong> option lets you map AD attributes to core Teramind fields (like Department, Position, Email, or Phone) or retain them as persistent custom fields for use in BI report filters. These mappings are saved and reused automatically on every sync, ensuring employee profiles stay perfectly aligned with your directory and preventing unwanted data overwrites.<\/p>\n\n\n\n![\"Flexible](\"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2026\/04\/Flexible-Mapping-for-Imported-LDAP-Attributes-scaled.png\" "\\"\\"")
<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"This release delivers heavy-hitting updates to the Mac Agent, extends Windows monitoring into native desktop applications like WhatsApp, and provides administrators with more granular tools to manage data and triage security alerts. Here is a summary of the new features and improvements available in this release. For an extensive list, please refer to the detailed […]<\/p>\n","protected":false},"author":8,"featured_media":12927,"comment_status":"closed","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[18],"tags":[],"ppma_author":[466],"class_list":["post-12910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-product-updates"],"authors":[{"term_id":466,"user_id":8,"is_guest":0,"slug":"arickteramind-co","display_name":"Arick Disilva","avatar_url":{"url":"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2024\/07\/arick.png","url2x":"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2024\/07\/arick.png"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/comments?post=12910"}],"version-history":[{"count":3,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910\/revisions"}],"predecessor-version":[{"id":12931,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910\/revisions\/12931"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/media\/12927"}],"wp:attachment":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/media?parent=12910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/categories?post=12910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/tags?post=12910"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/ppma_author?post=12910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
The Mac Agent now supports full monitoring of ChatGPT Web<\/strong> sessions. This feature tracks all user prompts, the corresponding AI-generated outputs, and attachment uploads. This is a critical addition for organizations looking to audit how generative AI is being used while ensuring sensitive company data isn’t being shared with public models. All data is surfaced in the LLM<\/strong> BI Report.<\/p>\n\n\n\n We have added support for tracking the AI Mode<\/strong> feature within Google Search on Mac. This ensures that chat interactions and file uploads within Google\u2019s AI ecosystem are captured. Like our ChatGPT monitoring, these interactions are logged in the LLM<\/strong> BI Report, providing a centralized view of AI tool usage for compliance and productivity tracking.<\/p>\n\n\n\n The Mac Agent now tracks file uploads to Google Drive<\/strong> across all major browsers which can be viewed under the Web File Events<\/strong> BI Report. Furthermore, you can now create Files Activity <\/strong>rules specifically for these uploads. By using criteria such as File Operation, Upload URL, or File Name, you can enforce policies or trigger alerts the moment a file is moved to this popular cloud repository.<\/p>\n\n\n\n To help organizations balance comprehensive evidence collection with storage efficiency, we\u2019ve enabled support for the RECORD ONLY WHEN BEHAVIOR RULE WAS VIOLATED<\/strong> option on Mac. When enabled, it will force the Agent to capture video only when a specific rule is triggered with the RECORD VIDEO<\/strong> action. This reduces storage needs, enhances user privacy, and ensures that security analysts only see the relevant “smoking gun” footage without the filler of routine daily activity.<\/p>\n\n\n\n Emails <\/strong>Activity rules on Mac now fully support Shared Lists<\/strong> in the To, CC, and From fields. This update allows you to quickly apply rules to multiple email recipients or senders and reuse the same list across different rules without manual duplication. Currently, this supports Gmail (web) and Outlook (web).<\/p>\n\n\n\n We\u2019ve improved the Mac Agent to better support environments that use Palo Alto Networks GlobalProtect <\/strong>VPN for all network access to perform SSL inspection \/ certificate injection on web traffic. The Agent now includes several configuration parameters that can be used to keep network monitoring working correctly when traffic is forced through the VPN.<\/p>\n\n\n\n This release expands Windows monitoring to WhatsApp desktop app, allows process name obfuscation and supports deployment in specialized security environments.<\/p>\n\n\n\n We have expanded our Instant Message\/IM <\/strong>monitoring and behavior rules to include the WhatsApp Desktop<\/strong> app. This update extends visibility beyond the browser, complementing our existing WhatsApp Web coverage to provide deeper oversight into employee communications and enforce automated rules, such as detecting insider risks or preventing data exfiltration.<\/p>\n\n\n\n The new We\u2019ve introduced support for STIG environments on Edge and Chrome browsers. This is achieved by enhancing how the Agent handles certificate revocation requests. The generated certificates now include all necessary revocation info, ensuring secure web accessibility while maintaining continuous monitoring in STIG-compliant environments.<\/p>\n\n\n\n Security analysts shouldn’t have to hunt for evidence. We\u2019ve introduced several features designed to reduce the “time to truth” during investigations and provide immediate context for every alert.<\/p>\n\n\n\n We have added a Session Player Url<\/strong> column to the Behavior Alerts report and API. This allows you to jump directly from an alert, whether you are viewing it in Teramind or an external SIEM\/SOAR tool – to the exact moment of the violation in the session recording. This eliminates the need to manually search for sessions or scrub through long videos.<\/p>\n\n\n\n Behavior Alerts<\/strong> descriptions now provide clearer context for violations that occur while a device is locked. Alerts triggered during these times will now be marked with a \u201c(Locked Session)\u201d<\/strong> label. This helps analysts quickly distinguish between background system processes and active user risk, improving the signal-to-noise ratio in investigations.<\/p>\n\n\n\n Maintaining a “single source of truth” for employee data shouldn’t be a manual chore. We’ve overhauled how Teramind interacts with your Active Directory integration to ensure data integrity across your organization.<\/p>\n\n\n\n Our AD\/LDAP integration is now significantly more granular. The new MAP IMPORTED ATTRIBUTES<\/strong> option lets you map AD attributes to core Teramind fields (like Department, Position, Email, or Phone) or retain them as persistent custom fields for use in BI report filters. These mappings are saved and reused automatically on every sync, ensuring employee profiles stay perfectly aligned with your directory and preventing unwanted data overwrites.<\/p>\n\n\n\n This release delivers heavy-hitting updates to the Mac Agent, extends Windows monitoring into native desktop applications like WhatsApp, and provides administrators with more granular tools to manage data and triage security alerts. Here is a summary of the new features and improvements available in this release. For an extensive list, please refer to the detailed […]<\/p>\n","protected":false},"author":8,"featured_media":12927,"comment_status":"closed","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[18],"tags":[],"ppma_author":[466],"class_list":["post-12910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-product-updates"],"authors":[{"term_id":466,"user_id":8,"is_guest":0,"slug":"arickteramind-co","display_name":"Arick Disilva","avatar_url":{"url":"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2024\/07\/arick.png","url2x":"https:\/\/www.teramind.co\/blog\/wp-content\/uploads\/2024\/07\/arick.png"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/comments?post=12910"}],"version-history":[{"count":3,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910\/revisions"}],"predecessor-version":[{"id":12931,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/posts\/12910\/revisions\/12931"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/media\/12927"}],"wp:attachment":[{"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/media?parent=12910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/categories?post=12910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/tags?post=12910"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.teramind.co\/blog\/wp-json\/wp\/v2\/ppma_author?post=12910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/figure>\n\n\n\nTracking AI Mode in Google Search<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nMonitoring and Rules Support for Google Drive Web Uploads<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nOptimized Evidence Collection with Record on Rule Violation Only<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nSupport for Shared Lists in Email Rules<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nPalo Alto GlobalProtect VPN Compatibility<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nExpanding Windows Monitoring and Compliance<\/strong><\/h1>\n\n\n\n
IM Monitoring for WhatsApp Desktop<\/strong><\/h2>\n\n\n\n
\n
<\/a><\/figure>\n<\/blockquote>\n\n\n\nCustom Stealth Parameters for Clipboard Monitoring<\/strong><\/h2>\n\n\n\n
TMCLIPMONEXE<\/code> <\/strong>installation parameter allows you to rename the clipboard monitor service of the Stealth Agent. By replacing the default process name with a custom name, you can obfuscate the process according to your internal security preferences and naming conventions.<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\nSupport for STIG Compliance<\/strong><\/h2>\n\n\n\n
Enhanced Alerting and Triage<\/strong><\/h1>\n\n\n\n
Link to Evidence Records with Session Player URLs<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nImproved Context with Locked Sessions Labels in Behavior Alerts<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n\n\n\nSeamless Directory Integration<\/strong><\/h1>\n\n\n\n
Flexible Mapping for Imported LDAP Attributes<\/strong><\/h2>\n\n\n\n
<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"