USER ACTIVITY MONITORING

What is USER ACTIVITY MONITORING?

Monitor internal activity. Detect anomalies. Respond to incidents.

Ekran System is a universal user activity monitoring software platform that covers each node of your infrastructure.

Session Recording

The Ekran System records on-screen user activity for all sessions in video format, indexed by the accompanying text metadata.

In addition, activity tracking software captures inbound and outbound audio streams on terminals.

It provides monitoring of Citrix and Windows user activity on servers and workstations with local, RDP, and terminal session recording. It also provides Telnet SSH session recording for Linux/UNIX servers.

Each session record includes important details about remote connections and user connection. You can also export it for additional research and analysis.

Advanced monitoring format

The Ekran System's central monitoring format is a high-performance video indexed with multi-layered metadata, including active application names, active window titles, visited sites (URLs), keystroke types, commands and scripts executed, and connected devices.

Video recording is an efficient tool for recording and monitoring user activity as it is complete and integrated, allowing for quick understanding and reconstruction and providing the tools to respond to a security incident.

At the same time, indexing text in multiple layers makes video records searchable and allows for in-depth investigation.

Real-time user activity monitoring and incident alerts

The Ekran system not only records user sessions, but also monitors user activities in real time.

Includes an AI-based user behavior analysis subsystem that continuously checks user activity against a normal baseline to detect deviations and possible account compromise in a timely manner. The Ekran System UEBA module can help security officers better detect internal threats when employees act maliciously for short periods of time or when they inadvertently leak corporate data.

It also includes another customizable rule-based alert subsystem that is used to double-protect the most critical assets and scenarios. You can use model library alerts - which cover the most common signs of internal threats - or create your own rules using a variety of parameters.

After an alert is triggered, everything is configured for a quick response to incidents. Notifications include suspicious session details and links to the corresponding video episodes for quick inspection. If the session is still running, a security officer can connect to it in real time. For the most critical alerts, you can assign automated blocking and warning actions.

USB monitoring and control

An important aspect of monitoring user activity is controlling the use of connected devices.

Ekran System's user tracking software includes powerful USB device monitoring and management functionality for handling storage devices as well as any type of USB equipment, including modems and keyboards.

The user's activity monitoring system can track device connections and can be configured to notify your security team about them. In addition to monitoring, the Ekran system can be configured to allow or block devices according to rules, blacklists, and whitelists.

Registry Filtering

The software to monitor user activity will record thousands of user actions on a normal day. Solutions to monitor the computer activity of multiple privileged users should provide tools to make logging more focused.

To record user activity optimally, the Ekran System offers several filtering options. You can write a selected number of key applications or set up a list of private/non-critical applications or URLs that you don't want to monitor.

Continuous Monitoring

A major requirement for any user activity monitoring tool is to ensure uninterrupted tracking of user activity under any conditions.

The software for tracking user activity includes an offline monitoring option. If the network connection on the client drops, the Ekran System Client continues to work, collecting monitoring data on secure storage on the client to send to central storage according to a performance protocol once the connection is restored.

The Ekran System Client and its data are protected from intrusion, monitoring users with any level of privilege. By enabling the modification of customer protection settings, you can avoid client uninstall, process interruption, solution component editing, and other actions to block monitoring.

System requirements:

CPU: 1.8 GHz dual core processor

RAM: 2 GB

HDD / SSD: 50 GB of free space on the main drive

Operating system: Microsoft Windows 8 32-bit, Microsoft Windows 7 32-bit and Microsoft Windows Vista 32-bit

Resolution: 1024×768