Ekran system functions v. 5.0
Download as PPTX, PDF0 likes589 views
Ekran System v. 5.0 is a comprehensive user monitoring solution that records various user activities, including video sessions and keystrokes, to enhance cybersecurity in organizations. It provides features such as user management, advanced authentication, USB monitoring, and real-time alerts for suspicious activities, while maintaining competitive pricing compared to other solutions. The system supports detailed reporting and integrates with SIEM tools, ensuring secure and efficient monitoring of both remote and local user interactions.
Ekran system functions v. 5.0
- 1. Ekran System v. 5.0 Program Overview
- 2. Contents • About the Program • Ekran Server & Management Tool • Database Management • Licensing • Client Installation • Monitoring Parameters • Client Protection • Advanced User Authentication • Notifying Users about Being Monitored • User Blocking • Viewing Sessions • Alerts • USB Monitoring • Dashboards • Interactive Monitoring • Reports Page 2 of 86
- 3. About the Program Page 3 of 86
- 4. About the Program Smart user activity video recording system. Page 4 of 86 Privileged Identity Management •Ekran System allows to create indexed video records of all concurrent Windows, Citrix, and Linux terminal sessions on your servers and record remote and local sessions on workstations. Employee Work Control •Are you interested in your company's security? •Do you want to know what your employees do during their working hours? •Do you want to control sensitive information use? Cost Saver on the Market •Ekran System provides all popular segment features while offering much more beneficial pricing than ObserveIT or Citrix Smart Auditor.
- 5. About the Program Ekran System is an affordable user monitoring solution for enhanced cyber security. You can record all terminal, remote, and local user sessions and alert security personnel to suspicious events. Page 5 of 86 Ekran Management Tool GUI part used for system management & session viewing Ekran Server Main component used for storing data obtained from Client computers Ekran Clients Windows/Linux/Citrix Components installed on the target computer to monitor user activity and send it to the Server Ekran System Components
- 6. Ekran System Structure Page 6 of 86
- 7. High Availability Mode (Enterprise Edition) Page 7 of 86 The High Availability mode provides a high level of operational performance and balances the load of sent data, minimizing downtime and service interruptions.
- 8. Ekran Server & Management Tool User management, permissions, Management Tool settings Page 8 of 86
- 9. Management Tool You can manage the whole system via the Management Tool in your browser. Page 9 of 86
- 10. User Management & Permissions • Create two types of users: Internal or Active Directory (Windows domain users/groups). • Use groups for easier user management. • Define permissions for users. Page 10 of 86
- 11. Management Tool Log Page 11 of 86 Audit all user activities performed in the Management Tool via the Management Tool Log with the detailed information on all changes.
- 12. Database Management Page 12 of 86
- 13. Database Configuration Page 13 of 86
- 14. Database Cleanup Page 14 of 86 One-Time Cleanup Scheduled Cleanup
- 15. Database Archiving (Enterprise Edition) Page 15 of 86 Archive and delete the old monitored data from the Database to not run out of space on the Server computer and to save the monitored data in a secure storage.
- 16. Database Archiving (Enterprise Edition) Page 16 of 86 You can view the archived sessions from your archived database in the Session Viewer and perform searches in them in a usual way at any time.
- 17. SIEM Integration Page 17 of 86 Ekran System integrates with your SIEM system using log files of the monitored events.
- 18. Advanced SIEM Integration Page 18 of 86 Create a CEF log file to get access to the Ekran System alert events and monitored data via the integral ArcSight or Splunk interface.
- 19. Licensing Types of Licenses & Serial Key Management Page 19 of 86
- 20. Licensing Page 20 of 86 Ekran System is licensed by the number of Ekran Clients, end-points to be monitored. All management components, including Server and Management Tool, are provided for free with any deployment. Types of Ekran Client licenses: • Windows workstation license • Windows server license • Linux machine license
- 21. Serial Key & License Management Page 21 of 86 Request a trial serial key for 30 days to deploy the system and review its basic features with a restriction of 5 workstation licenses, 1 server license, and 3 Linux licenses. To work with Ekran System for a longer period, license it by activating the serial keys on the computer with the installed Ekran Server. You can use either permanent keys, or subscription keys.
- 22. Enterprise Key Page 22 of 86 Activate Enterprise serial key to get exclusive access to a set of additional, valuable features of Enterprise Edition Ekran System.
- 23. Client Installation Page 23 of 86
- 24. Installing Ekran Clients Page 24 of 86 Convenient Ekran Client installation: • Local: o Linux Clients (via tar.gz file) o Windows Clients using installation file with default parameters using generated package with customized parameters • Remote (for Windows Clients) Remote Installation Select computers to install Clients on Customize installation parameters The Clients are successfully installed!
- 25. Target Computers for Remote Installation Page 25 of 86 • Scan your local computer network • Define a range of IP addresses to search the target computers • Simply enter target computer names
- 26. Monitoring Parameters Page 26 of 86
- 27. Client Monitoring Page 27 of 86 The data the Client sends is stored in the form of deltas (differences between a newer screen capture and an older one) to minimize storage space. Recorded information is saved in an easy-to-review and easy-to- search form: • The name of the launched application • The title of the active window • Entered URL • Text entered via user’s keyboard (keystrokes) • Commands executed in Linux (both from user input & by running the scripts) • The information on plugged-in USB devices
- 28. Screen Capturing Page 28 of 86 Ekran Client screen capture creation is event-triggered by default. You can configure the Client to capture active window only.
- 29. URL Monitoring Page 29 of 86 Ekran Client monitors URLs entered in web browsers. You can configure the Client to monitor full URLs or domains of top and second level only.
- 30. Keystroke Logging Page 30 of 86 Ekran Client captures all text entered through the user’s keyboard and adjusts it for better comprehension. Use a special Viewing keystrokes permission to limit user access to this sensitive data.
- 31. Keyword-Triggered Monitoring Page 31 of 86 You can configure Ekran Client to start monitoring and creating screen captures only after detecting the defined keywords entered by the user.
- 32. Application Filtering Page 32 of 86 Ekran System allows you to define the filtering rules for websites/applications to adjust the amount of monitored data and exclude the areas where private information can be observed to comply with corporate policy rules and country regulations related to user privacy.
- 33. Privileged User Monitoring Page 33 of 86 Monitor the activity of users logging in under privileged user accounts.
- 34. Client Group Settings Page 34 of 86 You can define the settings for a Client Group and then apply them to the Client to save your time.
- 35. Client Protection Page 35 of 86
- 36. Protected Mode Page 36 of 86 Ekran System allows you to protect the Client and its data by enabling the Protected Mode. The usage of Protected Mode has the following advantages: • Prevention of Client uninstallation. • Prevention of stopping Client processes. • Prevention of editing Client system files and logs. • Prevention of editing Client settings in the registry of the Client computer. • Prevention of modification, removal, and renaming of Client files.
- 37. Client Uninstallation Page 37 of 86 Users, including privileged ones, are unable to stop the Client working on their machines, as well as remove the Client locally without the Administrator assistance. Only Ekran System Administrator knows the uninstallation key defined prior to Client installation and necessary for local removal.
- 38. Advanced User Authentication Page 38 of 86
- 39. Advanced User Authentication Page 39 of 86 Advanced user authentication allows you to achieve two goals: • Monitor users’ activity on the computer when multiple users use the same credentials to log in. • Improve your security by limiting the access to the specific users who know secondary authentication credentials.
- 40. Advanced User Authentication Page 40 of 86 The Ekran System Client requests entering credentials before allowing a user to work with Windows Server.
- 41. One-Time Password Page 41 of 86 Enterprise Edition Ekran System provides the administrator with a unique ability to generate a one-time password for a user to login to the Client computer with Windows Server OS.
- 42. One-Time Password Page 42 of 86 The user can request a one-time password directly from the secondary authentication window displayed on login to Windows Server.
- 43. Notifying Users about Being Monitored Page 43 of 86
- 44. Notifying Users about Being Monitored Page 44 of 86 To follow the security policy of your company or your country regulations, you can: • Enable displaying an additional message on user logging in to notify the user that his or her work is being monitored. • Display a Client tray icon with the notification about monitoring to the user.
- 45. Notifying Users about Being Monitored Page 45 of 86 • Require the users to enter the comments to the additional message displayed on their login to the Client computers.
- 46. User Blocking Page 46 of 86
- 47. User Blocking Overview Page 47 of 86 Ekran System allows you to block users performing potentially harmful and forbidden actions on computers with Windows Server operating system with Ekran Clients installed on them. Users can be blocked from both Live and Finished sessions.
- 48. User Blocking Overview Page 48 of 86 The user desktop is blocked, and after the defined time interval the user is forcedly logged out. If the blocked user tries to log in to the Client computer, the system does not allow him/her to do so.
- 49. Viewing Blocked User List Page 49 of 86 The Blocked User List contains information on who, where, and when was blocked. To allow the users access to the Client Computer, remove them from the list.
- 50. Viewing Sessions Page 50 of 86
- 51. Searching Data in Session List Page 51 of 86 Ekran Management Tool allows searching in the recorded sessions. Search is performed by different parameters: • For Windows Clients: active window title, application name, user name, Client name, visited URL, entered keystrokes, user’s comment to the additional message, USB device information. • For Linux Clients: commands and command parameters.
- 52. Viewing Live Session Page 52 of 86 Ekran System allows you to perform monitoring of user activity in real time. You can connect to a Live session and observe the activities a user is performing at the given moment.
- 53. Magnifying Glass Page 53 of 86 You can enlarge certain parts of the video in the Session Player by using the Magnifying Glass.
- 54. Forensic Export Page 54 of 86 With Ekran System Forensic Export, you can: • Export a monitored session or its part to a securely encrypted file. • Investigate the recorded user activity in the in-built offline session viewer. • Present evidence in forensic format to the third parties.
- 55. Alerts Page 55 of 86
- 56. Setting Up Alerts Page 56 of 86 Ekran System allows you to enable quick incident response using alert notifications: • Set up alerts about suspicious user activity on the Client computers. • Specify individuals to receive instant alert notifications via email or in the Tray Notifications application.
- 57. Default Alerts Page 57 of 86 Ekran System contains a set of default alerts prepared by the vendor security experts. They will alarm you about data leakage, potentially fraudulent, illicit, or work-unrelated activities.
- 58. Alerts in Session Player Page 58 of 86 Monitored data associated with alert events is highlighted in different colors in the Session Player according to alert risk level.
- 59. Alerts in Alert Viewer Page 59 of 86 You can view detailed information on all alert events as well as screen captures associated with them in a special viewer.
- 60. Receiving Alerts Page 60 of 86 Receive alert notifications in real time, review them in the Ekran System Tray Notifications journal, and open the session with the alert-related data in the Session Player.
- 61. USB Monitoring Page 61 of 86
- 62. USB Monitoring Overview Page 62 of 86 Ekran System provides two types of monitoring USB devices plugged into the Client computer: • USB-based storage monitoring, to view information on the devices detected by Windows as mass storage and receive alert notifications. • Kernel-level USB monitoring, for an in-depth analysis of plugged- in devices and their blocking.
- 63. Setting Up Kernel-level USB Rules Page 63 of 86 Ekran System can detect USB devices connected to a computer, alert you on device plugging in, and block their usage (either all devices of a certain class or all except the allowed devices) on a Client computer.
- 64. USB-Based Storage Monitoring Page 64 of 86 USB-based storages are automatically detected on being plugged in.
- 65. Kernel-Level USB Monitoring Page 65 of 86 Screen captures created on USB devices being plugged in or blocked are highlighted in the Session Viewer.
- 66. Dashboards Page 66 of 86
- 67. Dashboards Overview Page 67 of 86 The dashboards offer a convenient real-time view of the most useful data grouped in one place. Customize the dashboards on the Management Tool Home page by adjusting their look and settings.
- 68. Dashboard Types Page 68 of 86 There are three main types of Ekran System dashboards: • System State Dashboards o Licenses o Clients o Database Storage Usage • Monitoring Dashboards o Recent Alerts o Latest Live Sessions • Threat Detection Dashboards o Sessions out of Work Hours o Rarely Used Computers o Rarely Used Logins
- 69. System State Dashboards Page 69 of 86 Clients Database Storage Usage Licenses
- 70. Monitoring Dashboards Page 70 of 86 Recent Alerts Latest Live Sessions
- 71. Threat Detection Dashboards Page 71 of 86 Rarely Used Computers Rarely Used Logins Sessions out of Work Hours
- 72. Interactive Monitoring Page 72 of 86
- 73. Interactive Monitoring Overview Page 73 of 86 You can filter out data by three parameters: • Who: filter by a specific user logged into the Client computer. • Where: filter by a specific Client. • When: filter by the time period. Additionally, you can set the order of bars being displayed, using the Applications and URLs filters. Data is displayed in the form of two column charts (Application Monitoring chart and URL Monitoring chart). To see the list of application/website entries, click on the column with the application/website name.
- 74. Application Monitoring Chart Page 74 of 86 This chart provides information on the application usage frequency. You can also use this chart to analyze information on the most rarely used applications and detect any threats and suspicious activity on investigated computers.
- 75. URL Monitoring Chart Page 75 of 86 This chart provides information on the website visiting frequency. You can also use this chart to analyze information on the most and least visited websites and detect potentially harmful activity on investigated computers.
- 76. Reports Page 76 of 86
- 77. Reports & Statistics Page 77 of 86 Ekran System Reports provide the full overview of the time spent in applications and on websites visited on the user’s machine. Generate a highly customizable report ad-hoc or schedule sending reports to your email on a daily, weekly, or monthly basis. The reported activity can include alerts, launched applications, visited web- sites, plugged-in/blocked USB devices, and executed Linux commands. Scheduled Reports
- 78. Reports & Statistics Page 78 of 86 The reports can be generated manually at any time for any time period. Manual Report Generation
- 79. Report Types Page 79 of 86 Activity summary report Activity pie chart report Activity chart report
- 80. Report Types Page 80 of 86 User statistics report
- 81. Report Types Page 81 of 86 Session grid report
- 82. Report Types Page 82 of 86 Alert grid report Keystroke grid report
- 83. Report Types Page 83 of 86 URL pie chart reportURL summary report URL chart report
- 84. Report Types Page 84 of 86 USB storage grid report Kernel-level USB storage grid report
- 85. Report Types Page 85 of 86 In the Linux grid report, you can view all exec* and sudo commands executed on Linux Client computers. Linux grid report
- 86. Visit us online: www.ekransystem.com Page 86 of 86