Contact UsContact Us

School Manager Red Flags and Alerts Guide

This guide is for wellbeing staff and school leadership.

An Introduction to Red Flags in School Manager 

Red Flags are tags that indicate the category and frequency of potentially risky web content users are attempting to access. The Red Flags report is most useful to school leadership and wellbeing staff who can advise and support students engaging in potentially risky behavior. 

Red Flags are triggered when a user: 

  • Attempts to access a website or app known to either be inappropriate or contain inappropriate content, such as pornography.
  • Attempts to access a tool or service that could be used to bypass filtering .
  • Searches for content using keywords or phrases identified as risky.

Use Red Flags as indicators, not to be looked at in isolation, but rather to be assessed in conjunction with other indicators when you are concerned about a user’s wellbeing. You can build a clearer picture of potential intent, to evaluate overall harm or distraction by using a combination of reporting tools.

You should investigate the cause of a Red Flag before taking any action with a user. Red Flags indicate potentially risky activity and may sometimes flag content which you might otherwise consider appropriate for the user to view.


Red flags require HTTPS inspection. IT Admins should refer to Setting Up HTTPS Inspection for instructions.

Reviewing Red Flags on the Dashboard 

The Red Flags are summarized in your Overview Dashboard. You can click View All or select a specific user’s Red Flag.

  1. VIEW ALL - redirects you to the Red Flags report.
  2. Selecting a Risk Indicator - redirects you to the corresponding Apps and Websites or Searches report for the selected user’s attempted access to this category of content.


Using the Red Flags Report

You can also navigate to Cyber Safety (shield icon) > RED FLAGS. 

Here you will see a list of users sorted by default with the largest number of serious Risk Indicators on the top.

  1. Search - type part of a student’s Username or Full Name to find their Red Flags data.
  2. Filter tag - type part of the category for a tag and select one or more tags to show users with any of these Risk Indicators. Reset the filter to clear and see all users and all Risk Indicators.
  3. Username - click the user’s ID to go to their User Report.
  4. Full Name - click the user’s name to go to their User Report.
  5. Risk Indicators - click one of the color-coded Red Flag tags identifying frequency attempted access to inappropriate content to go to the Apps and Websites or Searches detail report for this user’s activity relating to the selected Risk Indicator.


Understanding Red Flag Icons

Icons and Colors of Risk Indicators

You can identify the frequency and types of risky online activity by the color and clustering of the Red Flags in the Risk Indicators column.

The categories may contain both the content the user was allowed to access and was blocked from accessing. If you need to see the details of the content a user was blocked from accessing, go to the Blocked Report tool and select the user you are concerned about.


Red Flag Icons

You can quickly recognize the category of the Risk Indicator by the following icons.

A Globe means the user accessed or was trying to access content hosted on websites or web servers.

A Gear means the user used or tried to use apps and services, like VPNs, that may bypass filtering.

A Magnifying Glass will only be displayed with keywords from the search engines your IT Admin has set up (like Google, Bing, and the YouTube website).


Search terms and keywords cannot be captured if your school has not enabled one of the following:

  • HTTPS Inspection and SSL certificates
  • Linewize Connect on your user’s devices 

The HTTPS Inspection and SSL certificates will only capture keywords while your users are connected to your school’s on-campus network. If your school needs 24-7 filtering, Linewize Connect installed on your user’s devices and your IT administrator needs to enable off-campus filtering and MITM (Man In The Middle) for the specific search engines your school wants to monitor.


Red Flag Colors

While we refer to these elements as “Red Flags”, you will notice two other colors in the Risk Indicators. We often refer to the Risk Indicators as Red Flags because these tags appear in the Red Flags reports, dashboard tiles, and columns. The color of the Risk Indicator lets you know how frequently the user attempted to access this category of content for this category of online content.

Red indicates frequent attempts to access potentially risky content or conduct an unsafe search. 

This user's total number of attempts were greater than 5% of the blocked attempts in this category for all of the users in School Manager. Users with highest count red indicators will appear at the top of Red Flag lists in your dashboard, report pages, and email reports. Will be associated with the device, website, or search activity.

Pink indicates some consistency in trying to access potentially risky content or conduct an unsafe search. 

This user's total number of attempts in this category are between 2% and 5% compared to the total attempts in this category for all users. Users will usually appear in the middle of Red Flag lists when they have only pink and blue indicators.

Blue indicates a user has attempted to access potentially risky content or use unsafe search keywords on a few occasions, typically once or twice within the selected time period. 

The total number of attempts in this category are less than 2% of the attempts compared to the all other users. Users usually appear at the bottom of Red Flag lists if they only have blue categories.


Red Flag Categories

Overall, you will be able to assess potential threats by reviewing a common set of categories of Risk Indicators:

Adult Content

Websites and apps known to host videos, images, and audio of sexual or explicit content

Adult Content Search

Keywords, slang or code words associated with sexual or explicit content


Online activities causing psychological harm by repeated aggressive actions like teasing, shaming, rejecting or criticizing a person, especially on social media or within a social group


Negative feelings interfering with healthy social and mental interactions


An excessive number of devices are logged on with a student’s account, which may indicate a user sharing their login information with other users

Hate Speech

Threatening or abusive activities directed at traits and labels associated with groups of people

Offensive Content

Inappropriate topics such as vulgar and explicit language, images, video or audio that does not fit standard categories like Adult Content or Hate Speech

Substance Abuse

Tobacco, alcohol, and drugs, including behaviors associated with addiction


Ending one’s life which may include self-harm and associated behaviors


Planning or threatening harm, death or damage to people, property or objects of emotional or financial value


Apps and services used to hide online activity, anonymize a user's identity on a safe network, and bypass filtering


Filtering and Searching for Red Flags

Filtering for Students with Specific Red Flags

You can find users with specific Red Flags by adding filters to the Red Flags view. For example, you may want to quickly see which users may be trying to use a VPN to bypass filtering. 

  1. Go to Cyber Safety > RED FLAGS.
  2. Click in the Select filter tag and select a category. (You can also type the category name into the Select filter tag box and then select it.)

    In this example, we are looking for VPN Red Flags.

  3. You will see the active VPN filter tag listed in blue. You have the option to select another filter tag, remove the active filter tag (by clicking the X) or Reset Filters (to see all Red Flags).

    In this example, the VPN Red Flag is visible among several Risk Indicators for this user.

  4. You can also filter on multiple tags at a time. This will find any students with any one or both of the selected filter tags.

  5. The Red Flags report will display the users with both categories. You will also see the users with one or the other of the categories you selected.

  6. If you want to remove a category, click the X to the right of the category name.


Searching for a Student

To see what Red Flags have been triggered by a particular student, search for their name or username at the top of the window.


Investigating Detailed Timing of an User’s Red Flags

When you view the overview of your users’ Red Flags, you may notice a large cluster of Red Flags and become concerned about their behavior. From the Red Flags Report you can investigate the details of when and which websites your user tried to access for each Red Flag. 

  1. Click a Red Flag with the globe icon.
  2. The Apps and Websites report opens for the selected user. Click on a date to see the details of the blocked websites for the selected user.
  3. The User’s Timeline will open. You will see the time of day and the web addresses of the blocked content.


You can only see Red Flags while a user’s device is connected to the on-campus school network unless your school owns the device and has enabled 24/7 filtering


Reviewing a User’s Search History

If your IT Administrator is running HTTPS Inspection and has set up your students’ devices, you will be able to monitor search terms and keywords. The availability of search history can vary depending on if your students are using their own devices (BYOD Bring Your Own Device) or school managed devices. If you would like guidance on what search and keyword data is available to you, contact your Linewize Support or your IT Administrator.

  1. Select a filter tag to find a category of Red Flags you are concerned about. Click on one of the user’s Red Flags with a magnifying glass.
  2. The User’s Search History will open. Click on the search expression to see the results in Google.
  3. Review the topics.
    Knowing the search results for slang words and phrases may help you to support a student who is struggling with appropriate behavior.
  4. If you would like to investigate further, you can click on the User’s name to go to their Dashboard to see an overview and access details for that user.

If you notice a new search phrase and are concerned the word is a conduit for malicious activity ask your IT Admin or Filtering Administrator to add a filtering rule to block the phrase.

Exporting Red Flag Data

The two primary options for exporting Red Flags data. Your first option is to download the subtotaled count of categories for the users displayed in your Red Flags Report (see the steps below). 

Getting a summary of the categories of activity can help you document an improvement or emerging issue in online behavior among the group of students you support. You can even change the time period and export additional reports to compare the change over time.

The second option is to select a user and download their User Journey Report data. This will help you view the detailed activities and times of the allowed, blocked, and flagged web content a single user was attempting to access.

  1. Verify or change the date range for your Red Flags summary report. Click on the calendar at the top of your screen. Select a date range.
    We recommend a minimum of 2 days and a maximum of 2 weeks for most systems. Larger date ranges will take significantly longer to be compiled before you can download the data.
  2. Verify your Red Flag filters or click Reset Filters view all users. Then, click EXPORT.
  3. A CSV (Comma Separated Values) file will download to your computer. Find the file ending in .CSV and open it in your spreadsheet program.
    As desired, format your file, convert text to columns or add notes to your file. Refer to your spreadsheet publisher’s documentation for instructions.  

Receiving Notifications by Email

This article is ideal for teachers, school leadership, and wellbeing staff.

The "REDFLAG ALERT" is an automated email report to help school leadership and wellbeing staff monitor students who may need to provide an immediate intervention. Contact your IT Admin to set up email notifications for you.

After your "REDFLAG ALERT" email notifications are set up, look for email from with the subject, “[REDFLAG ALERT]”. You will also see the student’s name and the type of Red Flag in the subject. You will receive one email per Red Flag per student. 

Daily Email Limits

By default, School Manager will send a maximum of 50 emails in a 24 hour period. You can ask your IT Administrator to turn off "Rate Limiting" to allow all realtime email notifications.

When you open a Red Flag email, you will see:

  1. The Student’s name and School Manager device name
  2. Click to Go to the user dashboard to see a summary of web traffic, top traffic types, and subtotals of the count of the web content and searches by category. 
  3. Time and date of the Red Flag activity
  4. Category of the Red Flag
  5. When search terms or keywords can be captured, those will be listed in Request under the Red Flag. Click View in School Manager to go to the user’s Search Report.


Combining Your Resources 

You may want to review the time of day and types of content the user is accessing to trigger the email alerts. When you go to the User Dashboard, you can click USER JOURNEY to review the content that was allowed, blocked, and flagged for potential risks by the time of day and web address. You can use this information to decide how to best support this user.

Another tool to help you investigate the details of the user’s recent activity is on the User’s Dashboard. Click VIEW TIMELINE  to view a list of the time of day, websites, and amount of data sent or received. In the Verdict column, you will see which types of connections were allowed or blocked. Red connections were blocked and green connections were allowed.

You can use the Red Flags report to support your users who are engaging in potentially risky behavior. Ask your IT administrator for Red Flags email notifications if you need to respond quickly to a user who is at immediate risk. Keep record of your progress with users you are providing guidance to by downloading Red Flags, User Journey and User Timeline data. Overall, the Red Flags report helps you to monitor the wellbeing of your users.