Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in...

Ekran System v. 6.15

Program Overview

Contents

• About the Program • Ekran Server & Management Tool• Database Management• Licensing• Client Installation & Update• Monitoring Parameters• Offline Client Detection (“Lost”

Clients)• Client Protection• Advanced User Authentication• Two-Factor Authentication• Password Management• User and Entity Behavior

Analytics

• Administrator’s Approval on Login

• Granting User Access on Schedule

• Notifying Users about Being Monitored

• User Blocking• Viewing Sessions• Alerts • USB Monitoring• Dashboards• Interactive Monitoring• Reports• Application Customization• Health Monitoring

of 148

About the Program

of 148

About the Program

Smart user activity video recording system.

of 148

Privileged Activity

Monitoring

• Ekran System allows creating indexed video records of all concurrent Windows, Citrix, and Linux terminal sessions on your servers and record remote and local sessions on workstations, including macOS.

Employee Work Control

•Are you interested in your company's security?

•Do you want to know what your employees do during their working hours?

•Do you want to control sensitive information use?

Privileged Password and

Session Management

• Ekran System helps you to provide privileged access to critical assets and meet compliance requirements by securing, managing and monitoring privileged accounts and access.

Flexible Deployment and

Licensing

• Ekran System supports the widest range of platforms and infrastructure configurations delivering reliable deployments of any size, from pilot dozens to tens thousands of endpoints. Flexible licensing helps to fit budget and addresses project changes.

About the Program

Ekran System is an affordable user monitoring solution for enhanced cyber security.

You can record all terminal, remote, and local user sessions and alert security personnel to suspicious events.

of 148

Ekran Management Tool

GUI part used for system management &

session viewing

Ekran Server

Main component used for storing data

obtained from Client computers

Ekran Clients

Windows/macOS/Linux/Citrix

Components installed on the target computer to

monitor user activity and send it to the Server

Ekran System Components

Ekran System Structure

of 148

High Availability Mode (Enterprise Edition)

of 148

The High Availability mode provides a high level of operational performance and balances the load of sent data, minimizing downtime and service interruptions.

Disaster Recovery Mode

of 148

The Disaster Recovery mode allows you to configure and deploy Ekran System in such a way that if the Ekran Server stops functioning for any reason, another Ekran Server instance can replace it without data loss and reinstallation of the system.

Single-Tenant/Multi-Tenant Mode

of 148

The Multi-tenant mode allows multiple strongly isolated tenants to operate in Ekran System environment. Data of each tenant is independent and not accessible to other tenants.

Ekran Server & Management ToolUser management, permissions, Active Directory Integration, Management Tool settings

of 148

Management Tool

You can manage the whole system via the Management Tool in your browser.

of 148

Tenant Management

Ekran System has Single-tenant and Multi-tenant modes.

The Single-tenant mode is selected by default. In this mode, all users have access to all Clients and settings according to their permissions.

In the Multi tenant mode all tenant users have access to their tenant Clients, but they have no access to other tenants’ Clients, configurations, alerts, reports, etc.

You can switch to the Multi-tenant mode any time.

of 148

User Management & Permissions

• Create two types of users: Internal or Active Directory (Windows domain users/groups).

• Use groups for easier user management.

• Define permissions for users.

of 148

Active Directory Integration

of 148

Integration with Active Directory allows you to establish the domain trusts with multiple domains.

Active Directory Integration

of 148

Integration with Active Directory allows you to do the following:

• Add users & user groups from trusted domains to allow them to access the Management Tool and Client machines with enabled Forced User Authentication.

• Create alerts for domain groups to quickly respond to suspicious user activity on the Client computers belonging to trusted domains.

Management Tool Log

of 148

Audit all user activities performed in the Management Tool via the Management Tool Log with the detailed information on all changes.

Database Management

of 148

Database Configuration

of 148

Database Cleanup

of 148

You can configure the cleanup operation that can be applied either to a separate Client or to the Client Group.

Database Archiving (Enterprise Edition)

of 148

Archive and delete the old monitored data from the Database not to run out of space on the Server computer and to save the monitored data in a secure storage.

Database Archiving (Enterprise Edition)

of 148

You can view the archived sessions from your archived database in the Session Viewer and perform searches in them in a usual way at any time.

Database Parameters

of 148

If the database credentials defined during the Server installation have been changed according to your company policy, you can easily edit them without re-installing the Server. Also, you can define the location for storing binary data received during monitoring.

Isolating Database from Clients (Enterprise Edition)

of 148

You can disconnect all Clients from the database and send them offline so that you can fix issues with the database, run database cleanup and maintenance without stopping the Ekran Server. Once database work is restored, you can return all Clients online in one click.

SIEM Integration

of 148

Ekran System integrates with your SIEM system using log files of the monitored events.

Advanced SIEM Integration

of 148

Get access to the Ekran System alert events and monitored data by creating a separate log file in one of the following formats:

• Common Event Format (CEF)

• Log Event Extended Format (LEEF)

Advanced SIEM Integration

of 148

Ekran System allows sending the records about the alerted events and monitored data directly to SIEM systems such as Splunk, ArcSight, and QRadar.

Licensing

Types of Licenses & Serial Key Management

of 148

Licensing

of 148

Ekran System is licensed by the number of Ekran Clients, end-points to be monitored. All management components, including Server and Management Tool, are provided for free with any deployment.

Types of Ekran Client licenses:

• Terminal Server Client license

• Infrastructure Server Client license

• Workstation Client license

• Linux / UNIX Server Client license

Licensing

of 148

Serial Key & License Management

of 148

Request a trial serial key for 30 days to deploy the system and review its basic features with a restriction of 3 Workstation Client licenses, 3 Linux/UNIX Server Client licenses, and 1 Terminal Server Client license.

To work with Ekran System for a longer period, license it by activating the serial keys on the computer with the installed Ekran Server. You can use either permanent keys, or update and support keys.

Enterprise Key

of 148

Activate Enterprise serial key to get exclusive access to a set of additional, valuable features of Enterprise Edition of Ekran System.

Unique Enterprise Edition Features

of 148

Features available only for Enterprise Edition:

• High Availability

• Multi-tenant

• Password Management

• Offline Clients Detection (“Lost” Clients)

• Integration with Ticketing System

• Granting User Access on Schedule

• User Behavior Analysis

• Server Resource Monitoring

• Database Archiving

• Advanced SIEM Integration

• IP Filtering

• Approving USB Access by Administrator

• SWIFT Username Monitoring

• Audio Recording

Client Installation & Update

of 148

Installing Ekran Clients

of 148

Convenient Ekran Client installation:

• Local:

o Linux Clients (via tar.gz file)

o macOS Clients (via tar.gz file)

o Windows Clients

using installation file with default parameters

using generated package with customized parameters

• Remote (for Windows Clients)

Remote Installation

Select computers to install Clients on

Customize installation parameters

The Clients are successfully installed!

Target Computers for Remote Installation

of 148

• Scan your local computer network

• Define a range of IP addresses to search the target computers

• Simply enter target computer names

Updating Ekran Clients

of 148

When Ekran Server is updated to a newer version, all Clients are automatically updated to the same version after their first connection to the Server.

If you want to personally supervise the update process of target Clients, you can disable the Update Client automatically option on them.

Monitoring Parameters

of 148

Client Monitoring

of 148

The screen captures the Client sends are stored in the form of deltas (differences between a newer recorded screen capture and an older one) to minimize storage space.

Recorded information is saved in an easy-to-review and easy-to-search form:

• The name of the launched application

• The title of the active window

• Entered URL

• Text entered via user’s keyboard (keystrokes)

• Clipboard text data (copied and pasted text)

• Commands executed in Linux (both from user input & by running the scripts)

• The information on plugged-in USB devices

User Activity Recording

of 148

Ekran Client user activity recording is event-triggered by default.

You can configure Windows, macOS, and Linux Clients either to screenshot active window only or to record user activity without taking screenshots.

Audio Recording

of 148

Ekran System allows recording any output and input sounds that have been played on the Windows Client machines.

The audio data can be monitored and recorded in the following applications:

• Skype • Slack• Zoom

• Viber• WhatsApp• Firefox

• Chrome• Opera• Internet Explorer

URL Monitoring

of 148

Ekran Client monitors URLs entered in web browsers.

You can configure the Client to monitor full URLs or domains of top and second level only.

Keystroke Logging

of 148

To ensure the GDPR compliance, all logged keystrokes are hidden, but you can perform searches within them and create alerts to be triggered when specific words are typed.

Also, keystrokes can be filtered, which allows you to reduce the amount of information received from the Windows Client and grant that there is no privacy violation by defining applications where keystrokes will be monitored.

Keyword-Triggered Monitoring

of 148

You can configure Ekran Clients to start monitoring and creating screen captures only after detecting the defined keywords entered by the user in specified applications.

Clipboard Monitoring

of 148

Ekran Client captures all text data, which has been copied or cut and then pasted into documents, files, applications, browser address bar, etc. on the Windows Client machines.

You can adjust an alert to be triggered whenever the user copies or cuts information and pastes it.

Application Filtering

of 148

Ekran System allows you to define the filtering rules for websites/applications to adjust the amount of monitored data and exclude the areas where private information can be observed to comply with corporate policy rules and country regulations related to user privacy.

Monitoring Time Filtering

of 148

In addition to application filtering rules, you can define monitoring time filtering ones.

By selecting certain days of the week and defining specific hours, you can establish the bounds in which Ekran Clients will record all user activity.

IP Filtering

of 148

Additionally, you can filter out sessions from certain remote IP addresses or monitor only sessions from certain IP addresses.

SWIFT Username Monitoring

of 148

Ekran System allows recording the user name used for logging into the SWIFT network so you can easily identify such users.

Privileged User Monitoring

of 148

Monitor the activity of users logging in under privileged user accounts.

Bandwidth Usage Reduction

of 148

Ekran System allows you to configure bandwidth usage reduction parameters to manage the traffic volume from the Client to Ekran Server.

The following parameters can be configured:

• Screenshot Throttling

• Batch Registration Timeout

• Screenshot size reducing

Client Group Settings

of 148

You can define the settings for a Client Group and then apply them to the Client to save your time.

Monitoring via Linux Clients (X Window System)

of 148

The Ekran System remote SSH session monitoring provides the ability to monitor the commands executed in the terminal.

Monitoring of the Linux sessions started locally via the graphical interface is supported as well.

Monitoring via Linux Clients (Remote Sessions)

of 148

The remote Linux Client session contains:

• User actions (input commands and responses from the terminal)

• System calls

• Commands being executed in the running script

Monitoring via Linux Clients (Local Sessions)

of 148

The local Linux Client session for X Window System contains:

• Screenshots

• Application name

• Activity title

• Activity time

Offline Client Detection(“Lost” Clients)

of 148

Offline Clients Detection (“Lost” Clients)

of 148

Offline Client detection will help you to timely detect Clients that have stopped transmitting monitoring data. Just define the time period after which the Clients will be considered “lost” and get notified about such incidents.

Viewing Offline Clients (“Lost” Clients)

of 148

You can view all Clients that are offline for more than specified time period on the Offline Clients page.

Client Protection

of 148

Protected Mode

of 148

Ekran System allows you to protect Windows Clients and their data by enabling the Protected Mode.

The usage of Protected Mode has the following advantages:

• Prevention of Client uninstallation.

• Prevention of stopping Client processes.

• Prevention of editing Client system files and logs.

• Prevention of editing Client settings in the registry of the Client computer.

• Prevention of modification, removal, and renaming of Client files.

Client Uninstallation

of 148

Users, including privileged ones, are unable to stop the Client working on their machines, as well as remove the Client locally without the Administrator assistance.

Only Ekran System Administrator knows the uninstallation key defined prior to Client installation and necessary for local removal.

Advanced User Authentication

of 148

Advanced User Authentication

of 148

Advanced user authentication allows you to achieve two goals:

• Monitor users’ activity on the computer when multiple users use the same credentials to log in.

• Improve your security by limiting the access to the specific users who know secondary authentication credentials.

Advanced User Authentication (Windows Clients)

of 148

The Ekran System Client requests entering credentials before allowing a user to work with Windows OS.

One-Time Password (Windows Clients)

of 148

Enterprise Edition Ekran System provides the administrator with a unique ability to protect the Client computer with a one-time password.

One-Time Password (Windows Clients)

of 148

The user can request a one-time password directly from the secondary authentication window displayed on login to Windows OS.

Advanced User Authentication (Linux Clients)

of 148

The Ekran System Client requests entering credentials before allowing a user to work with the terminal on Linux Client machines.

Two-Factor Authentication

of 148

Two-factor authentication allows you to enable an extra layer of security to better protect the critical endpoints in your network.

of 148

Add users who will be allowed to log into the Windows and Linux machines with installed Clients using time-based one-time passwords (TOTP) generated in the TOTP mobile applications.

of 148

The Ekran System Client prompts the user to enter a TOTP to start working with the system.

Password Management

of 148

Password Management

of 148

Managing privileged accounts and implementing role-based access control is critical for enterprise security teams. Ekran System password management functionality provides you with full control and visibility over privileged user access.

With Ekran System, you can:

• Securely store credentials

• Provide granular access to stored credentials

• Manage passwords without interfering privileged users workflow

Adding Secret

of 148

Add a Secret to define a computer to be accessed to, privileged account credentials, and a user or user group to give access to.

Logging in Using Secret

of 148

The privileged user can access the critical endpoint via Secret using Ekran System Connection Manager.

Viewing Secrets in Sessions

of 148

You can easily navigate to user sessions in which a specific Secret was used. In addition, the Secret data is highlighted in blue in the Session Player so you can quickly find it.

User and Entity Behavior Analytics

of 148

Ekran System User and Entity Behavior Analytics (UEBA) allows you to better protect your system from malicious and illicit insiders.

UEBA has the following advantages in detecting suspicious activities:

• Analysis of user behavior patterns and establishment of a baseline for

normal behavior.

• Automatic detection of behavioral deviations.

• Timely notification of potential insider threats.

of 148

Add user behavior rule to view the user profiles, analyze the sessions with the detected anomalies, and get timely notified about the risky user activity.

of 148

The monitored sessions that contain detected user behavior anomalies have a special risk score.

The risk score indicates the severity level of the session and is calculated according to the risk level of the abnormal user behavior patterns and alerts detected in the monitored sessions.

Administrator’s Approval on Login

of 148

Administrator’s approval on login allows you to better protect the Client machines in your network from undesired access.

of 148

Add users whose access to the Client machines needs to be restricted.

of 148

When the restricted user logs into the Client machine, the Client blocks the desktop and sends the user’s access request to the administrator.

of 148

After the administrator confirms the user’s access request, the user is allowed to start working with the system.

Granting User Access on Schedule

of 148

Granting User Access on Schedule (Enterprise Edition)

of 148

Granting User Access on Schedule feature allows you to protect the Client computers from access at undesired time.

of 148

Add users whose access to the Client machines will be granted only for a certain period of time out of which the administrator’s approval on login will be required.

of 148

The restricted users will be able to log in to the Client computers during the defined time period and will need the administrator’s approval for login outside this period.

Notifying Users about Being Monitored

of 148

To follow the security policy of your company or your country regulations, you can:

• Enable displaying an additional message on user logging in to notify the user that his or her work is being monitored.

• Display a Client tray icon with the notification about monitoring to the user.

of 148

• Require the users to enter the comments to the additional message displayed on their login to the Client computers.

of 148

• Require the user to enter a valid ticket number created in the integrated ticketing system to start working with the Client machine.

of 148

• Display the icon on the desktop to inform the users that their actions are currently being recorded.

User Blocking

of 148

User Blocking Overview

of 148

Ekran System allows you to block users performing potentially harmful and forbidden actions on computers with Windows OS with Ekran Clients

installed on them.

Users can be blocked manually from both Live and Finished sessions, or automatically when they perform an action that triggers a specific alert.

User Blocking Overview

of 148

The user desktop is blocked, and after the defined time interval the user is forcibly logged out.

If the blocked user tries to log in to the Client computer, the system does not allow him/her to do so.

Viewing Blocked User List

of 148

The Blocked User List contains information on when, and why the user was blocked.

To allow the users access to the Client Computer, remove them from the list.

Viewing Sessions

of 148

Searching Data in Session List

of 148

Ekran System Management Tool allows searching in the recorded sessions.

Search is performed by different parameters:

• For Windows Clients: active window title, application name, user name, Client name, visited URL, clipboard text data, user’s comment to the additional message, ticket number, USB device information.

• For macOS Clients: active window title, application name, user name, Client name, visited URL.

• For Linux Clients: commands, command parameters, and command output.

Viewing Live Session

of 148

Ekran System allows you to perform monitoring of user activity and listen to the sounds being played on the Client machine in real time.

You can connect to a Live session and observe the activities a user is performing at the given moment.

Magnifying Glass

of 148

You can enlarge certain parts of the video in the Session Player by using the Magnifying Glass.

Forensic Export

of 148

With Ekran System Forensic Export, you can:

• Export a monitored session or its part to a securely encrypted file.

• Investigate the recorded user activity and audio data in the in-built offline session viewer.

• Present evidence in forensic format to the third parties.

Alerts

of 148

Setting Up Alerts

of 148

Ekran System allows you to enable quick incident response using alert notifications:

• Set up alerts about suspicious user activity on the Client computers.

• Specify individuals to receive instant alert notifications via email or in the Tray Notifications application.

You can set the alert to:

• Display a warning message to the user when the alert is triggered.

(The message can be edited)

• Block the user.

• Forcibly stop the application.

Alert Actions

of 148

Default Alerts

of 148

Ekran System contains a set of default alerts prepared by the vendor security experts. They will alarm you about data leakage, potentially fraudulent, illicit, or work-unrelated activities.

Alerts in Session Player

of 148

Monitored data associated with alert events is highlighted in different colors in the Session Player according to the alert risk level.

Alerts in Alert Viewer

of 148

You can view detailed information on all alert events as well as screen captures associated with them in a special viewer.

Receiving Alerts

of 148

Receive alert notifications in real time, review them in the Ekran System Tray Notifications journal, and open the session with the alert-related data in the Session Player.

USB Monitoring

of 148

USB Monitoring Overview

of 148

Ekran System provides two types of monitoring USB devices plugged into the Windows Client computer:

• USB-based storage monitoring, to view information on the devices detected by Windows as mass storage and receive alert notifications.

• Kernel-level USB monitoring, for an in-depth analysis of plugged-in devices and their blocking.

Setting Up Kernel-level USB Rules

of 148

Ekran System can detect mass storage devices connected to a computer, alert you on device plugging in, block their usage or forbid access to them until administrator’s approval (either all devices of a certain class or all except the allowed devices) on a Client computer.

USB-Based Storage Monitoring

of 148

USB-based storages are automatically detected on being plugged in.

Kernel-Level USB Monitoring

of 148

Screen captures created on USB devices being plugged in or blocked are highlighted in the Session Viewer.

Dashboards

of 148

Dashboards Overview

of 148

The dashboards offer a convenient real-time view of the most useful data grouped in one place.

Customize the dashboards on the Management Tool Home page by adjusting their look and settings.

Dashboard Types

of 148

There are four main types of Ekran System dashboards:

System State Dashboards

o Licenses

o Clients

o Database Storage Usage

Monitoring Dashboards

o Recent Alerts

o Latest Live Sessions

Threat Detection Dashboards

o Sessions out of Work Hours

o Rarely Used Computers

o Rarely Used Logins

Server Resource Monitoring

o CPU Usage

o Memory Usage

o Database State

System State Dashboards

of 148

Clients Database Storage Usage

Licenses

Monitoring Dashboards

of 148

Recent Alerts

Latest Live Sessions

Threat Detection Dashboards

of 148

Rarely Used Computers Rarely Used Logins

Sessions out of Work Hours

of 148

CPU Usage Memory Usage Database State

Interactive Monitoring

of 148

Interactive Monitoring Overview

of 148

You can filter out data by three parameters:

• Who: filter by a specific user logged into the Client computer.

• Where: filter by a specific Client.

• When: filter by the time period.

Additionally, you can set the order of bars being displayed, using the Applications and URLs filters.

Data is displayed in the form of two column charts (Application Monitoringchart and URL Monitoring chart).

To see the list of application/website entries, click on the column with the application/website name.

Application Monitoring Chart

of 148

This chart provides information on the application usage frequency.

You can also use this chart to analyze information on the most and least used applications and detect any threats and suspicious activity on investigated computers.

URL Monitoring Chart

of 148

This chart provides information on the website visiting frequency.

You can also use this chart to analyze information on the most and least visited websites and detect potentially harmful activity on investigated computers.

Reports

of 148

Reports & Statistics

of 148

Ekran System Reports provide the full overview of the time spent in applications and on websites visited on the user’s machine.

Generate a highly customizable report ad-hoc or schedule sending reports to your email on a daily, weekly, or monthly basis.

The reported activity can include alerts, launched applications, visited web-sites, plugged-in/blocked USB devices, and executed Linux commands.

Scheduled Reports

Reports & Statistics

of 148

The reports can be generated manually at any time for any time period.

Manual Report Generation

Report Types

of 148

Activity summary report Activity pie chart report

Activity chart report

Report Types

of 148

User statistics report

Clipboard grid report

Report Types

of 148

Session grid report

Sessions out of work hours grid report

Report Types

of 148

Detailed activity report

User daily activity grid report

Report Types

of 148

User Productivity report

Report Types

of 148

Alert grid report

Report Types

of 148

User behavior analysis report

Report Types

of 148

URL pie chart reportURL summary report

URL chart report

Report Types

of 148

USB storage grid report

Kernel-level USB storage grid report

Report Types

of 148

Terminal server grid report

Report Types

of 148

In the Linux grid report, you can view all exec* and sudo commands executed on Linux Client computers.

Linux grid report

Application Customization

of 148

Date and Time Format

of 148

Date&Time Format configuration allows you to define the date and time format for the Management Tool and the Server.

Custom Logo on Client Notifications

of 148

Custom Logo settings allow you to enable using custom graphic files instead of the default logo on the Client notifications during secondary authentication, user blocking, etc.

Report Customization

of 148

Custom Reports settings allow you to enable using custom graphic file instead of the default logo in the reports. Also, you can add the header and footer text in the reports.

Custom Email Subjects

of 148

Custom Email Subjects settings allow you to define the subjects to be used in email notifications sent by Ekran System.

Health Monitoring

of 148

System Health Monitoring

of 148

System Health Monitoring allows you to get detailed information about the database storage usage and errors occurring in Ekran System which helps to monitor the system “health” and react to any problems in time.

of 148

Ekran System allows you to see the resource usage by the Ekran System Server process at the moment:

• CPU Usage by Server process

• Memory Usage by Server process

• Database State

Visit us online:

www.ekransystem.com

of 148

Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in...

Documents

Screenshot Test

QC Screenshot

How to Take a Screenshot By Ashley Hudson Screenshot of this screen

Slideshow screenshot

Model Screenshot Presentation

AgentSuccessTracker.com Screenshot Tour

Socialtext Screenshot Gallery

Screenshot surveys

Screenshot aria

Ekran system functions v. 5.0

PECB case study - Ekran System · In 2017, PECB deployed Ekran System as their main employee activity monitoring tool, and our partnership continues today. Egzon Sinanaj, the Director

Screenshot Template Directions 1 Requirements Screenshot - Display Campaigns Partners need to provide one screenshot per site, per size for each unique

Leanus screenshot

HomePage screenshot

Ekran System v 6.18 High Availability Deployment Guide Availability...Ekran Server role in the failover cluster. NOTE: Optionally, you can install the Management Tool on several separate

Bladerunner Screenshot Analysis

Gigaset SL780 · 2 Ekran simgeleri Gigaset SL780 / TR / A31008-M2009-B401-2-5A19 / overview.fm / 11.11.2009 Version 4, 16.09.2005 Ekran simgeleri Ayarlara ve telefonunuzun işletim

Pccn online screenshot

AirPOS Screenshot

Screenshot photoshop