148
Ekran System v. 6.15 Program Overview

Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

  • Upload
    others

  • View
    3

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Ekran System v. 6.15

Program Overview

Page 2: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Contents

• About the Program • Ekran Server & Management Tool• Database Management• Licensing• Client Installation & Update• Monitoring Parameters• Offline Client Detection (“Lost”

Clients)• Client Protection• Advanced User Authentication• Two-Factor Authentication• Password Management• User and Entity Behavior

Analytics

• Administrator’s Approval on Login

• Granting User Access on Schedule

• Notifying Users about Being Monitored

• User Blocking• Viewing Sessions• Alerts • USB Monitoring• Dashboards• Interactive Monitoring• Reports• Application Customization• Health Monitoring

Page 2 of 148

Page 3: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

About the Program

Page 3 of 148

Page 4: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

About the Program

Smart user activity video recording system.

Page 4 of 148

Privileged Activity

Monitoring

• Ekran System allows creating indexed video records of all concurrent Windows, Citrix, and Linux terminal sessions on your servers and record remote and local sessions on workstations, including macOS.

Employee Work Control

•Are you interested in your company's security?

•Do you want to know what your employees do during their working hours?

•Do you want to control sensitive information use?

Privileged Password and

Session Management

• Ekran System helps you to provide privileged access to critical assets and meet compliance requirements by securing, managing and monitoring privileged accounts and access.

Flexible Deployment and

Licensing

• Ekran System supports the widest range of platforms and infrastructure configurations delivering reliable deployments of any size, from pilot dozens to tens thousands of endpoints. Flexible licensing helps to fit budget and addresses project changes.

Page 5: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

About the Program

Ekran System is an affordable user monitoring solution for enhanced cyber security.

You can record all terminal, remote, and local user sessions and alert security personnel to suspicious events.

Page 5 of 148

Ekran Management Tool

GUI part used for system management &

session viewing

Ekran Server

Main component used for storing data

obtained from Client computers

Ekran Clients

Windows/macOS/Linux/Citrix

Components installed on the target computer to

monitor user activity and send it to the Server

Ekran System Components

Page 6: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Ekran System Structure

Page 6 of 148

Page 7: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

High Availability Mode (Enterprise Edition)

Page 7 of 148

The High Availability mode provides a high level of operational performance and balances the load of sent data, minimizing downtime and service interruptions.

Page 8: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Disaster Recovery Mode

Page 8 of 148

The Disaster Recovery mode allows you to configure and deploy Ekran System in such a way that if the Ekran Server stops functioning for any reason, another Ekran Server instance can replace it without data loss and reinstallation of the system.

Page 9: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Single-Tenant/Multi-Tenant Mode

Page 9 of 148

The Multi-tenant mode allows multiple strongly isolated tenants to operate in Ekran System environment. Data of each tenant is independent and not accessible to other tenants.

Page 10: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Ekran Server & Management ToolUser management, permissions, Active Directory Integration, Management Tool settings

Page 10 of 148

Page 11: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Management Tool

You can manage the whole system via the Management Tool in your browser.

Page 11 of 148

Page 12: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Tenant Management

Ekran System has Single-tenant and Multi-tenant modes.

The Single-tenant mode is selected by default. In this mode, all users have access to all Clients and settings according to their permissions.

In the Multi tenant mode all tenant users have access to their tenant Clients, but they have no access to other tenants’ Clients, configurations, alerts, reports, etc.

You can switch to the Multi-tenant mode any time.

Page 12 of 148

Page 13: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User Management & Permissions

• Create two types of users: Internal or Active Directory (Windows domain users/groups).

• Use groups for easier user management.

• Define permissions for users.

Page 13 of 148

Page 14: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Active Directory Integration

Page 14 of 148

Integration with Active Directory allows you to establish the domain trusts with multiple domains.

Page 15: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Active Directory Integration

Page 15 of 148

Integration with Active Directory allows you to do the following:

• Add users & user groups from trusted domains to allow them to access the Management Tool and Client machines with enabled Forced User Authentication.

• Create alerts for domain groups to quickly respond to suspicious user activity on the Client computers belonging to trusted domains.

Page 16: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Management Tool Log

Page 16 of 148

Audit all user activities performed in the Management Tool via the Management Tool Log with the detailed information on all changes.

Page 17: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Management

Page 17 of 148

Page 18: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Configuration

Page 18 of 148

Page 19: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Cleanup

Page 19 of 148

You can configure the cleanup operation that can be applied either to a separate Client or to the Client Group.

Page 20: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Archiving (Enterprise Edition)

Page 20 of 148

Archive and delete the old monitored data from the Database not to run out of space on the Server computer and to save the monitored data in a secure storage.

Page 21: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Archiving (Enterprise Edition)

Page 21 of 148

You can view the archived sessions from your archived database in the Session Viewer and perform searches in them in a usual way at any time.

Page 22: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Database Parameters

Page 22 of 148

If the database credentials defined during the Server installation have been changed according to your company policy, you can easily edit them without re-installing the Server. Also, you can define the location for storing binary data received during monitoring.

Page 23: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Isolating Database from Clients (Enterprise Edition)

Page 23 of 148

You can disconnect all Clients from the database and send them offline so that you can fix issues with the database, run database cleanup and maintenance without stopping the Ekran Server. Once database work is restored, you can return all Clients online in one click.

Page 24: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

SIEM Integration

Page 24 of 148

Ekran System integrates with your SIEM system using log files of the monitored events.

Page 25: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced SIEM Integration

Page 25 of 148

Get access to the Ekran System alert events and monitored data by creating a separate log file in one of the following formats:

• Common Event Format (CEF)

• Log Event Extended Format (LEEF)

Page 26: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced SIEM Integration

Page 26 of 148

Ekran System allows sending the records about the alerted events and monitored data directly to SIEM systems such as Splunk, ArcSight, and QRadar.

Page 27: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Licensing

Types of Licenses & Serial Key Management

Page 27 of 148

Page 28: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Licensing

Page 28 of 148

Ekran System is licensed by the number of Ekran Clients, end-points to be monitored. All management components, including Server and Management Tool, are provided for free with any deployment.

Types of Ekran Client licenses:

• Terminal Server Client license

• Infrastructure Server Client license

• Workstation Client license

• Linux / UNIX Server Client license

Page 29: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Licensing

Page 29 of 148

Page 30: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Serial Key & License Management

Page 30 of 148

Request a trial serial key for 30 days to deploy the system and review its basic features with a restriction of 3 Workstation Client licenses, 3 Linux/UNIX Server Client licenses, and 1 Terminal Server Client license.

To work with Ekran System for a longer period, license it by activating the serial keys on the computer with the installed Ekran Server. You can use either permanent keys, or update and support keys.

Page 31: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Enterprise Key

Page 31 of 148

Activate Enterprise serial key to get exclusive access to a set of additional, valuable features of Enterprise Edition of Ekran System.

Page 32: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Unique Enterprise Edition Features

Page 32 of 148

Features available only for Enterprise Edition:

• High Availability

• Multi-tenant

• Password Management

• Offline Clients Detection (“Lost” Clients)

• Integration with Ticketing System

• Granting User Access on Schedule

• User Behavior Analysis

• Server Resource Monitoring

• Database Archiving

• Advanced SIEM Integration

• IP Filtering

• Approving USB Access by Administrator

• SWIFT Username Monitoring

• Audio Recording

Page 33: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Client Installation & Update

Page 33 of 148

Page 34: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Installing Ekran Clients

Page 34 of 148

Convenient Ekran Client installation:

• Local:

o Linux Clients (via tar.gz file)

o macOS Clients (via tar.gz file)

o Windows Clients

using installation file with default parameters

using generated package with customized parameters

• Remote (for Windows Clients)

Remote Installation

Select computers to install Clients on

Customize installation parameters

The Clients are successfully installed!

Page 35: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Target Computers for Remote Installation

Page 35 of 148

• Scan your local computer network

• Define a range of IP addresses to search the target computers

• Simply enter target computer names

Page 36: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Updating Ekran Clients

Page 36 of 148

When Ekran Server is updated to a newer version, all Clients are automatically updated to the same version after their first connection to the Server.

If you want to personally supervise the update process of target Clients, you can disable the Update Client automatically option on them.

Page 37: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring Parameters

Page 37 of 148

Page 38: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Client Monitoring

Page 38 of 148

The screen captures the Client sends are stored in the form of deltas (differences between a newer recorded screen capture and an older one) to minimize storage space.

Recorded information is saved in an easy-to-review and easy-to-search form:

• The name of the launched application

• The title of the active window

• Entered URL

• Text entered via user’s keyboard (keystrokes)

• Clipboard text data (copied and pasted text)

• Commands executed in Linux (both from user input & by running the scripts)

• The information on plugged-in USB devices

Page 39: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User Activity Recording

Page 39 of 148

Ekran Client user activity recording is event-triggered by default.

You can configure Windows, macOS, and Linux Clients either to screenshot active window only or to record user activity without taking screenshots.

Page 40: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Audio Recording

Page 40 of 148

Ekran System allows recording any output and input sounds that have been played on the Windows Client machines.

The audio data can be monitored and recorded in the following applications:

• Skype • Slack• Zoom

• Viber• WhatsApp• Firefox

• Chrome• Opera• Internet Explorer

Page 41: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

URL Monitoring

Page 41 of 148

Ekran Client monitors URLs entered in web browsers.

You can configure the Client to monitor full URLs or domains of top and second level only.

Page 42: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Keystroke Logging

Page 42 of 148

To ensure the GDPR compliance, all logged keystrokes are hidden, but you can perform searches within them and create alerts to be triggered when specific words are typed.

Also, keystrokes can be filtered, which allows you to reduce the amount of information received from the Windows Client and grant that there is no privacy violation by defining applications where keystrokes will be monitored.

Page 43: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Keyword-Triggered Monitoring

Page 43 of 148

You can configure Ekran Clients to start monitoring and creating screen captures only after detecting the defined keywords entered by the user in specified applications.

Page 44: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Clipboard Monitoring

Page 44 of 148

Ekran Client captures all text data, which has been copied or cut and then pasted into documents, files, applications, browser address bar, etc. on the Windows Client machines.

You can adjust an alert to be triggered whenever the user copies or cuts information and pastes it.

Page 45: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Application Filtering

Page 45 of 148

Ekran System allows you to define the filtering rules for websites/applications to adjust the amount of monitored data and exclude the areas where private information can be observed to comply with corporate policy rules and country regulations related to user privacy.

Page 46: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring Time Filtering

Page 46 of 148

In addition to application filtering rules, you can define monitoring time filtering ones.

By selecting certain days of the week and defining specific hours, you can establish the bounds in which Ekran Clients will record all user activity.

Page 47: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

IP Filtering

Page 47 of 148

Additionally, you can filter out sessions from certain remote IP addresses or monitor only sessions from certain IP addresses.

Page 48: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

SWIFT Username Monitoring

Page 48 of 148

Ekran System allows recording the user name used for logging into the SWIFT network so you can easily identify such users.

Page 49: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Privileged User Monitoring

Page 49 of 148

Monitor the activity of users logging in under privileged user accounts.

Page 50: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Bandwidth Usage Reduction

Page 50 of 148

Ekran System allows you to configure bandwidth usage reduction parameters to manage the traffic volume from the Client to Ekran Server.

The following parameters can be configured:

• Screenshot Throttling

• Batch Registration Timeout

• Screenshot size reducing

Page 51: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Client Group Settings

Page 51 of 148

You can define the settings for a Client Group and then apply them to the Client to save your time.

Page 52: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring via Linux Clients (X Window System)

Page 52 of 148

The Ekran System remote SSH session monitoring provides the ability to monitor the commands executed in the terminal.

Monitoring of the Linux sessions started locally via the graphical interface is supported as well.

Page 53: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring via Linux Clients (Remote Sessions)

Page 53 of 148

The remote Linux Client session contains:

• User actions (input commands and responses from the terminal)

• System calls

• Commands being executed in the running script

Page 54: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring via Linux Clients (Local Sessions)

Page 54 of 148

The local Linux Client session for X Window System contains:

• Screenshots

• Application name

• Activity title

• Activity time

Page 55: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Offline Client Detection(“Lost” Clients)

Page 55 of 148

Page 56: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Offline Clients Detection (“Lost” Clients)

Page 56 of 148

Offline Client detection will help you to timely detect Clients that have stopped transmitting monitoring data. Just define the time period after which the Clients will be considered “lost” and get notified about such incidents.

Page 57: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Viewing Offline Clients (“Lost” Clients)

Page 57 of 148

You can view all Clients that are offline for more than specified time period on the Offline Clients page.

Page 58: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Client Protection

Page 58 of 148

Page 59: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Protected Mode

Page 59 of 148

Ekran System allows you to protect Windows Clients and their data by enabling the Protected Mode.

The usage of Protected Mode has the following advantages:

• Prevention of Client uninstallation.

• Prevention of stopping Client processes.

• Prevention of editing Client system files and logs.

• Prevention of editing Client settings in the registry of the Client computer.

• Prevention of modification, removal, and renaming of Client files.

Page 60: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Client Uninstallation

Page 60 of 148

Users, including privileged ones, are unable to stop the Client working on their machines, as well as remove the Client locally without the Administrator assistance.

Only Ekran System Administrator knows the uninstallation key defined prior to Client installation and necessary for local removal.

Page 61: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced User Authentication

Page 61 of 148

Page 62: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced User Authentication

Page 62 of 148

Advanced user authentication allows you to achieve two goals:

• Monitor users’ activity on the computer when multiple users use the same credentials to log in.

• Improve your security by limiting the access to the specific users who know secondary authentication credentials.

Page 63: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced User Authentication (Windows Clients)

Page 63 of 148

The Ekran System Client requests entering credentials before allowing a user to work with Windows OS.

Page 64: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

One-Time Password (Windows Clients)

Page 64 of 148

Enterprise Edition Ekran System provides the administrator with a unique ability to protect the Client computer with a one-time password.

Page 65: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

One-Time Password (Windows Clients)

Page 65 of 148

The user can request a one-time password directly from the secondary authentication window displayed on login to Windows OS.

Page 66: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Advanced User Authentication (Linux Clients)

Page 66 of 148

The Ekran System Client requests entering credentials before allowing a user to work with the terminal on Linux Client machines.

Page 67: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Two-Factor Authentication

Page 67 of 148

Page 68: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Two-Factor Authentication

Page 68 of 148

Two-factor authentication allows you to enable an extra layer of security to better protect the critical endpoints in your network.

Page 69: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Two-Factor Authentication

Page 69 of 148

Add users who will be allowed to log into the Windows and Linux machines with installed Clients using time-based one-time passwords (TOTP) generated in the TOTP mobile applications.

Page 70: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Two-Factor Authentication

Page 70 of 148

The Ekran System Client prompts the user to enter a TOTP to start working with the system.

Page 71: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Password Management

Page 71 of 148

Page 72: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Password Management

Page 72 of 148

Managing privileged accounts and implementing role-based access control is critical for enterprise security teams. Ekran System password management functionality provides you with full control and visibility over privileged user access.

With Ekran System, you can:

• Securely store credentials

• Provide granular access to stored credentials

• Manage passwords without interfering privileged users workflow

Page 73: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Adding Secret

Page 73 of 148

Add a Secret to define a computer to be accessed to, privileged account credentials, and a user or user group to give access to.

Page 74: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Logging in Using Secret

Page 74 of 148

The privileged user can access the critical endpoint via Secret using Ekran System Connection Manager.

Page 75: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Viewing Secrets in Sessions

Page 75 of 148

You can easily navigate to user sessions in which a specific Secret was used. In addition, the Secret data is highlighted in blue in the Session Player so you can quickly find it.

Page 76: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User and Entity Behavior Analytics

Page 76 of 148

Page 77: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User and Entity Behavior Analytics

Page 77 of 148

Ekran System User and Entity Behavior Analytics (UEBA) allows you to better protect your system from malicious and illicit insiders.

UEBA has the following advantages in detecting suspicious activities:

• Analysis of user behavior patterns and establishment of a baseline for

normal behavior.

• Automatic detection of behavioral deviations.

• Timely notification of potential insider threats.

Page 78: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User and Entity Behavior Analytics

Page 78 of 148

Add user behavior rule to view the user profiles, analyze the sessions with the detected anomalies, and get timely notified about the risky user activity.

Page 79: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User and Entity Behavior Analytics

Page 79 of 148

The monitored sessions that contain detected user behavior anomalies have a special risk score.

The risk score indicates the severity level of the session and is calculated according to the risk level of the abnormal user behavior patterns and alerts detected in the monitored sessions.

Page 80: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Administrator’s Approval on Login

Page 80 of 148

Page 81: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Administrator’s Approval on Login

Page 81 of 148

Administrator’s approval on login allows you to better protect the Client machines in your network from undesired access.

Page 82: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Administrator’s Approval on Login

Page 82 of 148

Add users whose access to the Client machines needs to be restricted.

Page 83: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Administrator’s Approval on Login

Page 83 of 148

When the restricted user logs into the Client machine, the Client blocks the desktop and sends the user’s access request to the administrator.

Page 84: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Administrator’s Approval on Login

Page 84 of 148

After the administrator confirms the user’s access request, the user is allowed to start working with the system.

Page 85: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Granting User Access on Schedule

Page 85 of 148

Page 86: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Granting User Access on Schedule (Enterprise Edition)

Page 86 of 148

Granting User Access on Schedule feature allows you to protect the Client computers from access at undesired time.

Page 87: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Granting User Access on Schedule (Enterprise Edition)

Page 87 of 148

Add users whose access to the Client machines will be granted only for a certain period of time out of which the administrator’s approval on login will be required.

Page 88: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Granting User Access on Schedule (Enterprise Edition)

Page 88 of 148

The restricted users will be able to log in to the Client computers during the defined time period and will need the administrator’s approval for login outside this period.

Page 89: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Notifying Users about Being Monitored

Page 89 of 148

Page 90: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Notifying Users about Being Monitored

Page 90 of 148

To follow the security policy of your company or your country regulations, you can:

• Enable displaying an additional message on user logging in to notify the user that his or her work is being monitored.

• Display a Client tray icon with the notification about monitoring to the user.

Page 91: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Notifying Users about Being Monitored

Page 91 of 148

• Require the users to enter the comments to the additional message displayed on their login to the Client computers.

Page 92: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Notifying Users about Being Monitored

Page 92 of 148

• Require the user to enter a valid ticket number created in the integrated ticketing system to start working with the Client machine.

Page 93: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Notifying Users about Being Monitored

Page 93 of 148

• Display the icon on the desktop to inform the users that their actions are currently being recorded.

Page 94: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User Blocking

Page 94 of 148

Page 95: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User Blocking Overview

Page 95 of 148

Ekran System allows you to block users performing potentially harmful and forbidden actions on computers with Windows OS with Ekran Clients

installed on them.

Users can be blocked manually from both Live and Finished sessions, or automatically when they perform an action that triggers a specific alert.

Page 96: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

User Blocking Overview

Page 96 of 148

The user desktop is blocked, and after the defined time interval the user is forcibly logged out.

If the blocked user tries to log in to the Client computer, the system does not allow him/her to do so.

Page 97: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Viewing Blocked User List

Page 97 of 148

The Blocked User List contains information on when, and why the user was blocked.

To allow the users access to the Client Computer, remove them from the list.

Page 98: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Viewing Sessions

Page 98 of 148

Page 99: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Searching Data in Session List

Page 99 of 148

Ekran System Management Tool allows searching in the recorded sessions.

Search is performed by different parameters:

• For Windows Clients: active window title, application name, user name, Client name, visited URL, clipboard text data, user’s comment to the additional message, ticket number, USB device information.

• For macOS Clients: active window title, application name, user name, Client name, visited URL.

• For Linux Clients: commands, command parameters, and command output.

Page 100: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Viewing Live Session

Page 100 of 148

Ekran System allows you to perform monitoring of user activity and listen to the sounds being played on the Client machine in real time.

You can connect to a Live session and observe the activities a user is performing at the given moment.

Page 101: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Magnifying Glass

Page 101 of 148

You can enlarge certain parts of the video in the Session Player by using the Magnifying Glass.

Page 102: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Forensic Export

Page 102 of 148

With Ekran System Forensic Export, you can:

• Export a monitored session or its part to a securely encrypted file.

• Investigate the recorded user activity and audio data in the in-built offline session viewer.

• Present evidence in forensic format to the third parties.

Page 103: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Alerts

Page 103 of 148

Page 104: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Setting Up Alerts

Page 104 of 148

Ekran System allows you to enable quick incident response using alert notifications:

• Set up alerts about suspicious user activity on the Client computers.

• Specify individuals to receive instant alert notifications via email or in the Tray Notifications application.

Page 105: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

You can set the alert to:

• Display a warning message to the user when the alert is triggered.

(The message can be edited)

• Block the user.

• Forcibly stop the application.

Alert Actions

Page 105 of 148

Page 106: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Default Alerts

Page 106 of 148

Ekran System contains a set of default alerts prepared by the vendor security experts. They will alarm you about data leakage, potentially fraudulent, illicit, or work-unrelated activities.

Page 107: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Alerts in Session Player

Page 107 of 148

Monitored data associated with alert events is highlighted in different colors in the Session Player according to the alert risk level.

Page 108: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Alerts in Alert Viewer

Page 108 of 148

You can view detailed information on all alert events as well as screen captures associated with them in a special viewer.

Page 109: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Receiving Alerts

Page 109 of 148

Receive alert notifications in real time, review them in the Ekran System Tray Notifications journal, and open the session with the alert-related data in the Session Player.

Page 110: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

USB Monitoring

Page 110 of 148

Page 111: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

USB Monitoring Overview

Page 111 of 148

Ekran System provides two types of monitoring USB devices plugged into the Windows Client computer:

• USB-based storage monitoring, to view information on the devices detected by Windows as mass storage and receive alert notifications.

• Kernel-level USB monitoring, for an in-depth analysis of plugged-in devices and their blocking.

Page 112: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Setting Up Kernel-level USB Rules

Page 112 of 148

Ekran System can detect mass storage devices connected to a computer, alert you on device plugging in, block their usage or forbid access to them until administrator’s approval (either all devices of a certain class or all except the allowed devices) on a Client computer.

Page 113: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

USB-Based Storage Monitoring

Page 113 of 148

USB-based storages are automatically detected on being plugged in.

Page 114: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Kernel-Level USB Monitoring

Page 114 of 148

Screen captures created on USB devices being plugged in or blocked are highlighted in the Session Viewer.

Page 115: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Dashboards

Page 115 of 148

Page 116: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Dashboards Overview

Page 116 of 148

The dashboards offer a convenient real-time view of the most useful data grouped in one place.

Customize the dashboards on the Management Tool Home page by adjusting their look and settings.

Page 117: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Dashboard Types

Page 117 of 148

There are four main types of Ekran System dashboards:

System State Dashboards

o Licenses

o Clients

o Database Storage Usage

Monitoring Dashboards

o Recent Alerts

o Latest Live Sessions

Threat Detection Dashboards

o Sessions out of Work Hours

o Rarely Used Computers

o Rarely Used Logins

Server Resource Monitoring

o CPU Usage

o Memory Usage

o Database State

Page 118: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

System State Dashboards

Page 118 of 148

Clients Database Storage Usage

Licenses

Page 119: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Monitoring Dashboards

Page 119 of 148

Recent Alerts

Latest Live Sessions

Page 120: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Threat Detection Dashboards

Page 120 of 148

Rarely Used Computers Rarely Used Logins

Sessions out of Work Hours

Page 121: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Server Resource Monitoring

Page 121 of 148

CPU Usage Memory Usage Database State

Page 122: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Interactive Monitoring

Page 122 of 148

Page 123: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Interactive Monitoring Overview

Page 123 of 148

You can filter out data by three parameters:

• Who: filter by a specific user logged into the Client computer.

• Where: filter by a specific Client.

• When: filter by the time period.

Additionally, you can set the order of bars being displayed, using the Applications and URLs filters.

Data is displayed in the form of two column charts (Application Monitoringchart and URL Monitoring chart).

To see the list of application/website entries, click on the column with the application/website name.

Page 124: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Application Monitoring Chart

Page 124 of 148

This chart provides information on the application usage frequency.

You can also use this chart to analyze information on the most and least used applications and detect any threats and suspicious activity on investigated computers.

Page 125: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

URL Monitoring Chart

Page 125 of 148

This chart provides information on the website visiting frequency.

You can also use this chart to analyze information on the most and least visited websites and detect potentially harmful activity on investigated computers.

Page 126: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Reports

Page 126 of 148

Page 127: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Reports & Statistics

Page 127 of 148

Ekran System Reports provide the full overview of the time spent in applications and on websites visited on the user’s machine.

Generate a highly customizable report ad-hoc or schedule sending reports to your email on a daily, weekly, or monthly basis.

The reported activity can include alerts, launched applications, visited web-sites, plugged-in/blocked USB devices, and executed Linux commands.

Scheduled Reports

Page 128: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Reports & Statistics

Page 128 of 148

The reports can be generated manually at any time for any time period.

Manual Report Generation

Page 129: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 129 of 148

Activity summary report Activity pie chart report

Activity chart report

Page 130: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 130 of 148

User statistics report

Clipboard grid report

Page 131: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 131 of 148

Session grid report

Sessions out of work hours grid report

Page 132: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 132 of 148

Detailed activity report

User daily activity grid report

Page 133: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 133 of 148

User Productivity report

Page 134: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 134 of 148

Alert grid report

Page 135: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 135 of 148

User behavior analysis report

Page 136: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 136 of 148

URL pie chart reportURL summary report

URL chart report

Page 137: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 137 of 148

USB storage grid report

Kernel-level USB storage grid report

Page 138: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 138 of 148

Terminal server grid report

Page 139: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Types

Page 139 of 148

In the Linux grid report, you can view all exec* and sudo commands executed on Linux Client computers.

Linux grid report

Page 140: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Application Customization

Page 140 of 148

Page 141: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Date and Time Format

Page 141 of 148

Date&Time Format configuration allows you to define the date and time format for the Management Tool and the Server.

Page 142: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Custom Logo on Client Notifications

Page 142 of 148

Custom Logo settings allow you to enable using custom graphic files instead of the default logo on the Client notifications during secondary authentication, user blocking, etc.

Page 143: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Report Customization

Page 143 of 148

Custom Reports settings allow you to enable using custom graphic file instead of the default logo in the reports. Also, you can add the header and footer text in the reports.

Page 144: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Custom Email Subjects

Page 144 of 148

Custom Email Subjects settings allow you to define the subjects to be used in email notifications sent by Ekran System.

Page 145: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Health Monitoring

Page 145 of 148

Page 146: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

System Health Monitoring

Page 146 of 148

System Health Monitoring allows you to get detailed information about the database storage usage and errors occurring in Ekran System which helps to monitor the system “health” and react to any problems in time.

Page 147: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Server Resource Monitoring

Page 147 of 148

Ekran System allows you to see the resource usage by the Ekran System Server process at the moment:

• CPU Usage by Server process

• Memory Usage by Server process

• Database State

Page 148: Ekran System v. 6...To work with Ekran System for a longer period, ... • Commands executed in Linux (both from user input & by running the scripts) ... screenshot active window only

Visit us online:

www.ekransystem.com

Page 148 of 148