Browsium Proton Administration Guide

Transcription

1 Browsium Proton Administration Guide Version 4.6 Browser Management for Enterprise

2 1 Administration Guide This guide has been created for IT administrators to assist in installing, configuring, and deploying Browsium Proton. This is version of the guide is designed for use with Browsium Proton 4.6. For more information about Browsium, or to contact customer support, please visit

3 2 Table of Contents 1. Introduction Browsium Proton Explained Browsium Proton Overview Browsium Proton Browser Integration Installation Proton Components Proton Setup Browsium Client Setup System Requirements BCMS Service & Database Browsium Client Proton Manager Installing Browisum Client Management (Proton) Server Installing Browsium Client Using Browsium Client (Proton) Manager Dashboard Dashboard Navigation Controls Bar Chart View Clients Section Status Java ActiveX... 28

4 Activity Section Web Applications Performance Java ActiveX Rules Page Building a rule Editing a rule Configuration Page Client Configuration Data Retention Data Collection Options Users Page Password Policy Management Privacy Page Diagnostics Page Tutorial Connecting to Proton Manager for the First Time Connecting to the Proton Manager Self-Signed Certificate Errors Creating the First Account Exporting Proton Report Data Views Creating Rules Create and Test a Map Rule Create and Test an Ignore Rule A. Troubleshooting A.1. Browsium Client fails to report data A.2. Browsium Client Management Server appears to fail installation A.3. Proton not working with Microsoft Edge A.4. Proton reports not displaying properly... 81

5 4 A.5. Proton Server showing certificate warnings... 81

6 5 Section One Introduction In this section, you will learn: Where Browsium Proton fills the void left by traditional software management systems What components make up Browsium Proton How Browsium Proton seamlessly integrates into your desktop environment

7 6 1. Introduction Proton delivers the ability to know and understand more than ever before about web applications in the enterprise. Historically IT organizations have been forced to play catch up when it comes to managing web applications. On the modern desktop, business applications are nearly always run in the browser instead of as traditional executable programs. Most IT organizations are prepared with tools and processes that help them manage installed, executable programs as IT was able to definitively and tightly control the desktop. Applications could not be installed without IT permission. Dependencies could be managed, packaged and isolated to ensure high levels of desktop and application availability and meet internal SLAs or SLTs. Understanding the web based application management challenge requires understanding browser design constructs and how that relates to existing desktop application solutions. The web browser has revolutionized IT and driven a change in nearly all aspects of business application delivery. Early browser based applications were fairly straightforward and requirements relatively streamlined with web application development practices and languages limiting the complexity of designs. As browsers became more ubiquitous, driven mainly by the popularity of Internet businesses, browser capabilities needed to expand to offer the range of new features and capabilities. Commercial use cases were becoming more complex and enterprise software vendors began to understand the power of the browser, so vendors began to move away from client/server solutions and offer web based versions of their software. These complex business applications required not only an advanced set of web development languages and technologies but also included specific dependencies and software extensibility to deliver their full solution. Managing these powerful web applications requires following a similar, but uniquely different approach to end user workstation management. The client/server models, where applications can be packaged, bundled and even designed to dynamically load custom libraries without impacting other system resources, have given way to an entirely more open, flexible, and complex approach. Web based applications are designed such that the browser loads those components, making development easier as resources are readily available to consume but the browser design intentionally limits the ability for more than one version of the same component to be loaded simultaneously. But web based application management isn t all about controlling library loading. One of the major problems facing IT administrators trying to manage desktops is their lack of ability to control web based application proliferation. Business units can easily create a web application and make it part of their standard business process without ever talking to anyone in IT. Web

8 7 server software is readily available, if not already installed on many Windows SKUs. Contractors can be hired to create a small web portal and integrate that with other business systems to build a limitless set of functions desired by the business unit. Business unit owners enjoy this approach as it enables rapid deployment for a desired solution and allows for a more nimble business response to objectives and needs. For IT however, the ease at which these systems can be brought online creates seemingly endless challenges. The most critical issue is that IT is unaware the system even exists. IT is expected to ensure reliable desktop operations, including browser functionality, but lacks basic data about the environment to successfully meet that objective. For web applications where IT is made aware, they are then faced with understanding and documenting requirements. With that information in hand, IT can begin to evaluate how these new systems overlay with existing systems, technologies and dependencies. Finally, IT is close to a position where they can begin to understand how to ensure delivery of this business critical web application. More often than not during that process, IT uncovers conflicts in dependencies. These systems rarely go through any change control or standards reviews. The technologies used are often not in line with organizationally defined standards, creating a challenge to then modify the system to bring it in line with everything else. Another major challenge IT faces in managing the modern web based desktop environment is patch management and inventory control. Traditional desktop management tools easily enable an IT administrator to inventory systems to obtain library and patch version information. Similarly, they could pull usage statistics to understand what was being used and by whom. Browser based applications function differently and the traditional tools can t provide that information. Traditional desktop management tools can provide an inventory of installed browser extensions (generally just the binary package information) but they lack mechanisms to indicate which are actually being used. Or which web applications are using those components. From a security perspective the tools lack the ability to indicate which components are not needed, and can therefore be removed and reduce unnecessary attack surface. Proton was designed to fill these gaps and meet the unique challenges IT faces in modern desktop management and web based applications. The paradigm has shifted, the browser is here to stay and web applications need proper management tools for IT to deliver services. Browsium Proton is the tool for the job.

9 Browsium Proton Explained Browsium Proton is an advanced web application inventory and analysis software solution. It provides a critical set of tools and data unavailable using traditional desktop management tools. Unlike other browser based data harvesting tools, Proton is enterprise ready. It s designed to immediately record and report across an organization within minutes of deployment. Customizable data filters and dashboard analysis reporting views ensures Proton will deliver crucial ongoing management information as the organizations web based applications evolve and the desktop management challenges increase with it. Proton integrates seamlessly with client browsers, gathering and synchronizing activity and web application behavior. End users experience no impact from Proton, nor does it impact the web applications running inside the browser. As data is collected, the Proton functionality in the Browsium Client passes that information over secure channels to the Proton Server. The Proton Server communicates with the Proton Manager, a web application that displays reports and analyzes the collected data. Like traditional desktop management tools which install to the operating system to monitor and report on user settings and system activity, Proton works by being tightly integrated into the browser. This design enables Proton to go well beyond what traditional desktop management tools can offer using their external process monitoring approach. As a tightly coupled part of the browser, Proton is able to see data as it is passed to rendering components, providing a unique view of content and browser behaviors. Browsium Client also gathers data about other browser extensions, including state, version and usage activity. This information, along with many other data points, are fed up to the Proton server database which then correlates information for viewing. Proton Server is not just a database and reporting analysis engine it also provides client configuration rules and parameters. This design makes it easy to manage all aspects of Proton from one place reporting and configuration are part of the server system. Clients only need to be installed and setup once, changes and reconfigurations are picked up by the clients automatically, making management overhead minimal. Browsium Proton is integrated with the BCMS to help reduce overhead and streamline technical resource usage. Using this design companies must have BCMS setup first, then activate the Proton product via license key in order to use the Proton system. It is not possible to setup a standalone Proton Server and not have a BCMS server starting with the 4.6 release.

10 Browsium Proton Overview Organizations have long relied on software management systems to enable centralized and robust desktop management. Traditional software management systems were designed for either a client/server model or to manage standalone applications, concepts that were the norm before the modern desktop of today where most applications are run in the browser. As the browser evolved to be a killer app used by information workers on a nearly constant basis, the management tools didn t evolve to meet this new paradigm. Browsium Proton ( Proton ) was designed for the modern desktop management challenge, uniquely focused on the requirements and challenges of web based applications. In broad terms, the browser is more like an operating system than it is a traditional desktop application. Like an operating system, the browser provides a host environment to run a range of applications, written in a wide set of programming languages, utilizing a virtually limitless set of extensions/add-ons and APIs. In addition, browser based applications have security and other environmental settings requirements or restrictions to ensure they balance the right amount of access and restrictive controls. Existing and traditional software management tools simply can t address these challenges. Proton fills this gap by providing web application inventory and analysis data. Much like traditional systems monitoring software which looks at Windows system settings, Executable and Linked Library binaries, Proton delivers the same types of data and information but from within the browser environment. Residing in that part of the web application stack Proton is able to get unparalleled access to data and configuration information. Proton can see basic information such as which web application is being used, to specific details such as which version of Java is required by a specific web application. The data collected by Proton, combined with the analytical provided via the dashboard and drilldown reporting interface, enables an organization understand who uses which applications and what dependencies exist, determine active web application usage activity, and ensure desktop configurations are managed to ensure proper operations while minimizing security or support exposure.

11 Browsium Proton Browser Integration Much like traditional desktop management tools, the real value comes from the breadth of reach as much as depth. The modern desktop is browser based, and usually not just a single browser. Through the desire to offer end user choice, based on web application requirements, or even benchmark performance criteria, many organizations need to deal with at least two browsers on the desktop. No organization would select a desktop management solution that only supported one version of Windows. Similarly, no web application management platform can be built around a single browser. Proton supports the four most popular browsers in the enterprise: Microsoft Internet Explorer, Microsoft Edge, Google Chrome, and Mozilla Firefox. Usage, setting and metric information is gathered seamlessly across the browser, regardless of which one the user has selected or was directed to use in the case of Browsium Catalyst. Proton goes further and can be easily integrated with virtual desktops to enable the same high fidelity level of data collection and analysis on virtual or physical delivery mechanisms. Proton is truly built for the modern enterprise desktop environment.

12 11 Section Two Installation In this section, you will learn: About the Browsium Proton components Software requirements for Browsium Proton How to Install Browsium Proton How to configure command line switches for installation over a network

13 12 2. Installation With the release of version 4.6, Browsium Proton is easier than ever to get up and running. Now integrated with the new Browsium Client Management Server, getting Proton up and running only requires entering a product key. Since BCMS and Proton share a common database backend, and some of the configuration and management tasks overlap, it only made sense to integrate the front-end portions as well. The installation process for Proton requires setting up a BCMS server first. Instructions for doing that can be found in the Browsium Client Management Server guide. Once the BCMS server is setup, ensure the Proton license key is installed and the system is active. Then continue with this guide to learn more about the Proton interface, capabilities and even a basic tutorial walkthrough. To collect data and get the most out of the Proton system, the Browsium Client will need to be installed on desktop systems in the organization. Administrator rights are required for installation of the standalone Browsium Client but requires only standard user permissions during use. The Browsium Client EXE can also be packaged for use in a software distribution system with typical software installation settings. Refer to section 2.5 for the available command-line switches. The remainder of this section provides details on the individual components of Proton, along with important information to ensure a successful installation.

14 Proton Components Browsium Proton is comprised of four main components: Proton Service, Proton Database, Proton Manager and Browsium Client. Proton Service and Proton Database can be run on a single server, or distributed and clustered among multiple servers to increase scalability. For the purposes of this guide, Proton Server refers to the logical grouping of Proton Service and Proton Database. Each component can be seen in relation to the others in the following diagram and are explained in more detail below. Browsium Client Manager Service a web service, running on IIS (or IIS Express in the case of Proton Express) that communicates with all other Proton components to facilitate data collection, reporting, and client management. Browsium Client Manager (Proton) Database a highly scalable database, built on Microsoft SQL Server, that holds all the data collected from clients and queries for the reporting system. Browsium Client Manager a web application that provides the user interface into the Proton Server for reporting and configuration. Browsium Client a lightweight software agent used for gathering inventory and activity data and automatically (and silently) uploading it to the Browsium Client Management Server. The Browsium Client also includes the agent functionality for Browsium Ion and Browsium Catalyst, resulting in a single client installation that works with all the modules in the Browsium suite. With the introduction of the Browsium Client Management Server and integration with Browsium Proton, each of the components above (except the Client) are shared with BCMS. Only a single database instance is required to support both Proton and BCMS. Likewise with the Proton Service. The Proton Manager is limited to some additional navigation tabs and screens within the BCMS interface.

15 Proton Setup As mentioned previously, getting Proton setup and running is merely a matter of entering the Proton license key in BCMS and the server and service components are ready to go Browsium Client Setup Browsium Client Setup (Browsium-ClientSetup.exe) installs the browser extensions and the Browsium Controller (BrowsiumController.exe) on end user systems. Browsium Controller manages communications with the Proton Server, along with managing configuration and control of the extensions. Browsium Management Service (BrowsiumService.exe) runs as a Windows service with System privileges to handle content loading for Ion and Catalyst projects that require elevated permissions. Browsium Monitor (BrowsiumMonitor.exe) is responsible for ensuring that Browsium Controller is running reliably. o o o o Browsium Client Extension Microsoft Internet Explorer An extension to facilitate Proton communication between Microsoft Internet Explorer and the Browsium Controller. Browsium Client Extension for Microsoft Edge An extension to facilitate Proton communication between Microsoft Edge and the Browsium Controller. Browsium Client Extension for Google Chrome an extension to facilitate Proton communication between Google Chrome and the Browsium Controller. Browsium Client Extension for Mozilla Firefox An extension to facilitate Proton communication between Mozilla Firefox and the Browsium Controller. The standalone Browsium-ClientSetup.exe is needed to enable Proton on additional client systems. This installer can be downloaded from the BCMS Manager web page or extracted from the Browsium Proton zip file that you were provided by Browsium. See section 2.4 for more details on installing Browsium Client.

16 System Requirements The BCMS environment, and embedded Proton feature set, is designed to support a wide range of Windows systems and configurations. This section details the minimum requirements for each component of Proton BCMS Service & Database Operating System.NET Framework Additional Components Processor Memory Windows Server 2008 R2 or later Version 4.0 or later Microsoft IIS 7 or later Microsoft SQL Server 2012 Web Edition or higher 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 2 GB RAM Browsium Client Operating System Browsers.NET Framework Processor Memory Windows 7 or later Windows Server 2008 R2 or later (for terminal servers) Microsoft Internet Explorer 8, 9, 10, or 11 Microsoft Edge 40 or later (machine must be domain joined) Google Chrome 39 or later Mozilla Firefox 48 or later (41 or later with Browsium legacy extension) Version 3.5 SP1 or later (full version only) 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 1 GB RAM, 2 GB for multi-user terminal servers Proton Manager Proton Manager is a client-side web application hosted on your server that provides the user interface to Proton, including the charts, reports, data, analytics, configuration, and administration interfaces.

17 16 Recall the Proton Manager is incorporated into the BCMS Manager. It is not a standalone component and is not installed separately from the BCMS installation. Browsium Client Manager is a client-side web application, all the code necessary to render the user interface is run completely within your browser. Because all the code runs in your browser, Browsium Client Manager works best when accessed via the most modern, fastest browsers available. We recommend Internet Explorer 11 or the latest version of Chrome or Firefox Installing Browisum Client Management (Proton) Server There is no Proton specific setup or installer. BCMS must be installed first, and the Proton features activated by entering a valid license code. To install BCMS, see the Browsium Client Management Server Administration Guide and follow the steps for installation and setup. Once you have a functioning server, next install Browsium Client using Browsium- ClientSetup.msi, which requires the address of your BCMS server to complete setup. When setup is complete see section 4.1 for instructions on how to connect to the Proton Manager Installing Browsium Client The value of Proton data relies on having active client systems generating usage, activity and inventory data. Information on installation and deployment of the Browsium Client package can be found in the Browsium Client Installation and Deployment Guide.

18 17 Section Three Introduction to Proton Reporting In this section you will learn: More about the Proton reporting system Where to find configuration settings in Proton How to filter data and view reports in Proton

19 18 3. Using Browsium Client (Proton) Manager The Browsium Client Manager is the front-end for Proton data reporting. The Manager also provides basic administrative tools for managing Proton clients reporting behavior Dashboard The Browsium Client Manager s default view is the dashboard, which provides a high-level view of the latest data collected by Proton clients in the organization. By default, the charts will update in real time so long as the auto refresh option remains selected. There are 3 main elements to the default Dashboard view: the navigation ribbon on the left side, the controls bar along the top, and the chart view in the middle Dashboard Navigation Users and administrators can navigate through the Manager via this navigation ribbon. Click on any line to change the Chart View to the desired view. The navigation ribbon can be collapsed or expanded by clicking on the hamburger button in the control bar:

20 19 The following screenshots show the nagivation ribbon s default view and collapsed view for Proton for each user type. Administrator Power User User Each of the options available in the navigation panel will be discussed in detail below. Proton Administrator accounts have access to view and modify three pages Users, Privacy, and Diagnostics that non-administrative users will not see. Power Users have access to view and modify the Configuration and Rules pages while (standard) Users can only view these pages in read-only mode.

21 Controls Bar The Controls Bar contains a variety of links and controls for Browsium Client Manager. The hamburger control ( ) will collapse or expand the left-most Navigation bar. The server URL ( in the screenshot above) shows which BCMS server the Manager is currently connected to. The settings control ( ) provides access to advanced features including downloading the Browsium Client, changing the password for the user currently logged into the Manager, and logging out of the Manager. Use Log out to connect to a different Proton server. User accounts and passwords are stored in the Proton server (in the database), not in the Manager. The Manager application can be used to log into various Proton servers, but only one at a time for each browser instance. If the Auto-refresh button is enabled, then any data updates made by active Proton clients will be automatically reflected in the current view (charts and graphs will update automatically when new data is uploaded and processed).

22 21 The date picker control allows you to select a date range, in UTC time, to filter Proton data in the current view. The date picker will automatically compute {Today} and {Yesterday} and replace them with month and day. Note that any given date in UTC time may be different than the date in your local time zone. The following table provides the details on what you will see for each date picker selection. Selection {Today} {Yesterday} Last 7 Days Last 30 Days This Month Last Month Custom Range Description Only data collected since 12:00 midnight UTC will be shown Only data collected between 12:00 midnight and 11:59pm UTC the day before will be shown All data collected in the previous 7 days (including today) will be shown. This is the default data filter for Proton All data collected in the previous 30 days (including today) will be shown Only data collected since the 1 st of the current month will be shown Only data collected during the previous month will be shown Allows the administrator to designate custom start and end dates for the view Once a date range is selected, the Chart View will update automatically to display only data from the user s selection.

23 Chart View The Chart View area displays the data currently selected by the navigation ribbon. By default, the Dashboard shows a high-level summary from all Proton clients per the date range selected in the date picker. This page is useful for seeing at-a-glance the breadth of connected Proton clients and their installed software (Java, Browsers, etc.). Clicking on any graph or header will navigate the user to the appropriate page to drill in to further details. These widgets can be reorganized or collapsed for user preference. Look for additional widgets to be added in future releases.

24 Clients Section The Clients section of the navigation bar provides access to detailed client data for the PCs connected to your Proton server. The five sub-pages provide client connectivity and inventory information for Status, Java and ActiveX Status The Status page will display all Proton clients that are, or have, connected to the server.

25 24 You can narrow the list of clients by typing search criteria into the search bar To disable data collection from a specific client, check the box next to it in the list and click the Disable button. This will prevent that client from uploading any data in the future. Note that existing data already uploaded by that client will remain and will not be removed or filtered. Client data upload can be re-enabled by selecting the appropriate clients and selecting Enable. For a full report on a specific client, click it from the list to see a summary view of installed software, with access to additional information via the Java, ActiveX, and Web Activity tabs. The following screenshot provides an example of a client running Windows 7 with a variety browsers installed. This client has all the Browsium modules active and Browsium extensions enabled. The Java tabs shows us the versions of Java installed on this client.

26 25

27 26 The ActiveX tabs shows us the ActiveX controls installed on this client. Web Activity provides easy access to a filtered view of the web applications access by this client.

28 Java The Java page displays a list of all Java versions installed on Proton clients throughout your organization. Clicking on any specific row will display the list of clients with that version of Java installed.

29 ActiveX The ActiveX page displays a list of all ActiveX controls installed on Proton clients across your entire organization.

30 29 The table lists all installed ActiveX controls and version information as well as a list of how many clients have that particular ActiveX control installed and enabled. In addition, Proton collects and reports on ActiveX control security data, as well as related usage/activity data for each client. Click on any ActiveX control in the table for the list of clients that have that control installed

31 Activity Section The Activity section of the navigation bar provides access to detailed activity data for your organization s web applications. The four sub-pages provide usage reports for Web Applications, Performance, Java, and ActiveX. These reports provide very granular data in easy-to-read tables and graphs that provide key insights on a wide range of scenarios. These include reporting which web applications are most frequently accessed by which users, which applications are performing abnormally, and which web applications utilize specific versions of Java or ActiveX controls. The following sections provide a drilldown on the reports found in each sub-page Web Applications The Web Applications page provides a view of accesses to each web application, sorted by the largest number of accesses by default, along with the number of users and machines from which those accesses occurred and any script errors occurring for that web application. The script errors data collection switch must be enabled on a per-web application basis, in the Summary tab of the Activity Detail view it is off by default.

32 31 This report is comprised of a visualization of popular applications at the top (in graph form), and the full list of applications visited at the bottom (in table form) in the Accesses section. A filter at the top of each Activity page allows you to easily limit the results displayed by zone, browser, machine name or domain user, Client IP, AD Site, or User OU values: Usage Graph

33 32 Hover the mouse pointer over any element in the graph to see more information: This will display both the application / site name as well as the number of times that particular application was accessed in the date range currently being viewed Accesses View The table lists results based on filters applied and date range chosen in the date picker control: Name of unique web applications visited Number of times in total that web application has been visited Number of unique users who have visited that web application Number of unique machines that have visited that web application (as machines can have more than one user) Script errors that have been logged by users access that web application Users can find information in the list by typing relevant web application names or sub-strings in the search box. The search box is limited to searching the web application name field today. Filters can be used to filter the view by browser, zone, and many other parameters.

34 33 Click on any row in the table for detailed information about that web application. Additional details on page level activity can be accessed by clicking any row of the Activity Detail page to access the Web Application Details for a given web application. Page level Activity Detail reporting includes additional information about Document Mode, X-UA-Compatibility/META Tags, and User Agent values Browser View Selecting the Browsers view of the table will instead show which browsers, document modes, Ion profiles, and Internet Explorer Zones have been used to access the web applications Activity Detail View Proton includes a granular display of the details for every web application. Select any web application from the Access or Browsers view, then click to open the Activity Detail view. The Summary tab of the Activity Detail view includes the name and description of the web application, along with the option to edit the fields so that they re more relevant to your organization. You ll also see summary usage stats, displaying the number of accesses, users,

35 34 URLs, and user accounts (if user account tracking is enabled) during the date range selected in the data picker control. Data collection options provides granular control, per web application, for enabling collection of performance analytics, script errors, and server IP addresses. Each of these settings has a master control on the Configuration page, which must be enabled before you can enable the data collection option for a given web application. The Users tab provides details on unique user accesses, including org unit, and machine names. This information can be anonymized using Privacy Mode.

36 35 The Users tab also includes web application performance data that is collected on the client with each web application access. In this view, you can see data for web page load times for each user of the web application including the count of measurements, minimum, mean, and maximum values. Sorting by this column (descending) is an easy way to see which users are having a slower experience with this web application. You can often pick out patterns here users with the same org unit, for example. Keep in mind that the load times shown here are aggregate across all URLs in the web application, so it might simply be that some users have different usage profiles (e.g. a tendency to access more complex pages in the web app). Drilling down from here into the actual accesses will enable you to explore that data in more detail. The URLs tab includes details on rule matches (see the Rules Page for more information on rules), accesses, load times, browsers used, document modes invoked, Java versions used, Ion profiles invoked, Internet Explorer zones, and script errors. This tab also includes page load times, although the view here is grouped by URL rather than user. Sorting by page load time (descending) here will show you what URLs tend to be loaded more slowly and drilling down from here will show you the actual accesses (with all the user, component, browser, and timing data) that have contributed to the load time data that is displayed. Clicking on any row in the URLs table will display the detailed activity for that URL. You ll be presented with rows of activity data, each representing a unique access to that web application

37 36 by an individual user. Complete details of these data tables are found in the Activity for URL section of this guide. The Performance tab provides detailed graphs of accesses, page load times, and total time for each web application for the period selected in the date picker control. This is called the Performance History report and is detailed in the Performance section of this guide.

38 Activity for URL In addition to the details for a given web application, Proton offers an even greater level of detail of each page access. Clicking on any URL value in the Web Application Details page will bring up the Accesses page. The default view for the Activity for URL page is the User view, where each row provides detailed info on the URL accessed. The data includes: Date of access Activity ID (an internal Proton value to uniquely identify each navigation) Machine and User information AD Site (if domain joined) IP Address Proton assigns an Activity ID to each navigation to ensure statistical and analytical consistency when Privacy features have been enabled. The Activity ID is unique to an action but when Privacy is enabled and user/machine data is anonymized, the Activity ID ensures report and data integrity while maintaining user anonymization. The next view, Components, displays detailed access information of any extension/add-ons used on the given pages. The data includes: Date of access

39 38 Activity ID (an internal Proton value assigned to navigations) Java Version (Requested and Used) ActiveX Control (Requested and Used The Browser view provides detailed access information about the browser criteria, modes and settings used to render the given pages. The data includes: Date of access Activity ID (an internal Proton value assigned to navigations) Detailed Browser version number (if greater than IE8) Document Mode (If using Internet Explorer) X-UA Compatible Meta Tag (If using Internet Explorer) User Agent value Ion Profile used (if applicable)

40 39 Switching to the Performance view includes the same date, and Activity ID, as well as more details on specific page load timing behaviors. The Total column provides information on the total page load time (in seconds). Total page load is defined as the sum of the Fetch and Process times. The Fetch column shows the time to retrieve the page (in seconds). The Fetch value is calculated from the time the navigation begins until the response is ended. The Process column provides the time to process and render the page (in seconds). The Process value is calculated from the time the response is ended until the DOM is completely loaded Performance Understanding how web applications are performing in your environment is essential to running an efficient enterprise. Business critical web applications suffering from poor performance can have a very significant cost impact to your company from lost end user productivity and generation of support tickets. For web applications used by employees in customer facing disciplines (e.g., customer support, sales, etc.), performance problems with the web application can directly impact the customer s experience with the company and the bottom line. On the IT side, web applications that are not scaled correctly for their loads can likewise have a significant cost in time and attention of IT employees due to extra monitoring and frequent emergency maintenance activity. Proton provides a very simple and powerful set of data and insights to assist you in troubleshooting and isolating web application performance issues, as seen by the actual client endpoints in your enterprise, at a granular level. Using this data, you can determine if performance problems exists on web applications for a single user, grouping of users, geographic basis, or if the issue is impacted by time of day or even by other browsing activity. This data identifies issues and anomalies that would otherwise be invisible to existing performance monitoring solutions.

41 40 Proton achieves this by collecting detailed performance metrics, including how long each page load takes on each client PC. With this data, Proton can summarize the performance of multiple web applications, including historical and current page load times, and surface how the current load times compare with the historical average. This is displayed on the main Performance page in the Activity section. The charts on this page allow you to quickly answer questions about web application performance in your enterprise. The chart on the left (Total Time) shows the total amount of time in minutes that end users are currently spending in each web application waiting for pages to load. This is a compound measurement that takes into account both the frequency of use and the speed of the web application, allowing you to focus on performance issues for the web applications that matter most to your organization. The green bar is the expected total time, based on the historical mean, while the yellow represents the unexpected total time, in excess of the historical mean. This allows you to answer the question which frequently used applications in my enterprise are currently significantly slower than usual? and gives you the ability to drill down and find out why. The chart on the right (Accesses), shows total number of accesses for each web application. The higher the count, the more popular, or heavily used, the web application is and the more relevant it is to your organization. If you see an application with a moderate yellow bar (unexpected load time) in the chart on the left, but a very high accesses count in the chart on the right, troubleshooting may be a high priority as a lot of users, or a smaller set of very active users, are affected. Conversely, if you see an application with a large unexpected load time in the chart on the left, but a small number of accesses on the right, that tells you that this application

42 41 is currently much slower than its historical average, but not very heavily used, and therefore may be a lower priority for troubleshooting. You can control the time interval using the dropdown above the charts. The default time interval is 5 minutes. A good practice is to set the time interval to be roughly 50% of the data push interval, set on the Configuration page. As with most charts in Proton, the underlying table is sortable by any column and will affect the chart display. By default, the table is sorted by Unexpected Load Time, with the highest first by default. When you sort the table by Total Time (descending), the charts allow you to answer the question where are my employees currently spending the most time?. You can also filter the table using the Filters at the top of the page or by searching for a specific web application using the Search box.

43 42 Selecting any row in the table will look up the activity detail for that web application, displaying the Performance History report (also found in the Performance tab within the Web Application Details View in section ).

44 43 The Performance History report is a quick and easy way to recognize patterns in performance over time for any given web application. On this page, you see a compound chart that displays number of accesses, page load time, and total time at an hourly granularity. Selecting any time period on the charts will highlight that period across all three charts and display a set of tables under the charts with the user and access details for that time period. Selecting anywhere else on the chart will de-select that time period. Because these three charts are synchronized on the axis of time, it s easy to see your usage patterns for the web application time of day, days of the week, along with the corresponding performance of the web application. For example, if you see that a web application page load time tends to increase regularly as accesses increase, you might want to look further at whether that web application is scaled appropriately for its load. These charts are also subject to the same top level filters as many other pages in Proton Manager, so it s easy to restrict the data to slices of your enterprise by geography, network topography, org unit, browser, or individual and see how the patterns change. This can help you diagnose performance issues affecting specific individuals, locations, or business units. After you have an interesting time slice identified, the tables below contain the data that you need to dive in and analyze the issue in more detail. As with other tables in Proton, you can even export the data to do more complex analytics in a tool of your choice.

45 Java With the many uses of Java, detailed reporting becomes critical. Accordingly, this report includes several breakout tabs to offer easily consumed views of the complex use cases for Java. The tab options are Activity by Version, Activity by URL, Ion Remediation, and Requested vs. Used. The Java report provides a view of all discrete Java versions used across all Proton client systems. On the Activity by URL, Ion Remediation and Requested vs. Used views, Clicking the link in the URL column will copy that value to the clipboard. Clicking any other data in that row brings up the Access detail page view for that URL Java Activity by Version The default view for this page is Activity by Version: Each row represents a unique Java version. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? Times Used is a count of how many times that version of Java has been instantiated by clients. This is useful for answering the question What s the most used version of Java in my org? The Used by Apps column indicates the number of distinct applications that have used that version of Java. This is useful for answering the question What is the version of Java that most applications use?

46 Java Activity by URL Each row represents a web application as a group of URLs, all of which are broken out within the grouped row. URL is the specific and detailed list of all URL associated with the specific web application. The Version column displays which Java version was used by the specified URL. Clicking this item brings up the Access detail page view for that URL. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? The Accesses column displays the number of times that URL was accessed Java Ion Remediation Browsium customers using Ion for Java management require this report to understand where Ion is used to replace Java versions for specific web applications. Each row represents a web application as a group of URLs, all of which are broken out within the grouped row.

47 46 URL is the specific and detailed list of all URL associated with the specific web application. Ion Profile indicates the name of the Ion Profile that was used to invoke a specific version of Java. Note that Ion Profile will only be displayed for Full profiles, not Limited Java profiles. The Version column displays which Java version was used by the specified URL. Clicking this item brings up the Access detail page view for that URL. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? The Accesses column displays the number of times that URL was accessed Java Requested vs. Used Each row represents a web application as a group of URLs, all of which are broken out within the grouped row. URL is the specific and detailed list of all URL associated with the specific web application. The Requested column indicates the version of Java requested by that specific web application/url. The value in Requested may be listed as Not Specified, which indicates the web application indicated a generic value for Java rather than a specific version value ID. The Used column indicates the version of Java actually used by the client for that specific web application/url. Clients indicates the total number of clients that have that version of Java installed.

48 47 Some Java web applications will request a specific version of Java be used, but if that version is not available, the default version of Java will be run instead. This may explain why the versions of Java requested vs the versions of Java used are different in your organization Java Applications by Version New to Proton 4.1 is the ability to track Java usage instantiated from within the browser but running outside as a standalone application. Some examples of these applications would be applications launched using Java Web Start ActiveX The ActiveX Usage report provides a view of all discrete ActiveX controls installed on any Proton client systems, including ActiveX control security values. The data can be viewed in several different ways, based on Activity usage.

49 ActiveX Activity by Control The first view provides a row by row listing of each ActiveX control and the following specifics: Detailed version number Number of client systems on which it is installed Number of times that control was accessed by any visited web application Number of unique web applications where the ActiveX control was accessed Security marker values for the given control: Safe for Scripting and Safe for Initialization Click any row in the report for more detailed information about that particular ActiveX control:

50 49 A filter at the top of the chart allows users to easily find Java versions as instantiated by zone, browser, machine name or domain user, Client IP, AD Site, or User OU values: In addition, columns can be sorted in ascending or descending order by clicking on the arrow sort button next to the column label ActiveX Activity by URL This view provides a view of the ActiveX control data by URL, enabling an easy way for administrators and security staff to see what is required (or requested) for a given web application. The items on this view are: Web application (name if defined, otherwise the TLD) URL (detailed path value) Name of the ActiveX control referenced Specific version of the ActiveX control loaded Number of client systems on which the ActiveX control was used

51 50 Number of accesses for the given URL Clicking the detail in a row brings up the Access view page for the given URL ActiveX Requested vs. Used Another way Proton can help an organization is through audit and compliance validation. The Requested vs. Used report provides a navigation level view of which ActiveX controls were requested by a given URL, correlated to that control actually being loaded. This data is essential to ensure validation of internal controls, as well as provide a resource when attempting to investigate when and where a specific control is needed so the use can be locked down or eliminated. The data in this chart includes: Web application (name if defined, otherwise the TLD) URL (detailed path value) Name of the ActiveX control referenced Specific version of the ActiveX control loaded (or not used ) Number of client systems on which the activity occurred Clicking the detail in a row brings up the Access view page for the given URL.

52 Rules Page The rules engine allows Proton administrators to either ignore specific web applications or map a URL to a specific web application. Enabled rules are applied to all Proton clients and are processed and updated on clients each time they report data to the Proton server. By default, no rules are enabled or configured in Proton. To add a new rule, select the New Rule button. Two types of rules supported in Proton: Map and Ignore. Map rules allow Proton administrators to assign URLs to a specific web application. This is useful when a single Web application has multiple URLs and allows the administrator to make them appear as a single web application in the Proton reports. Ignore rules allow Proton administrators to filter out web applications that are of no interest, for example search web sites such as Google.com, Bing.com or Yahoo.com. You may want to exclude a range of activity to categories of sites, such as social media or search engines, etc., accessed by Proton clients. Proton enables you to define multiple Map or Ignore rules in one step. To upload a premade or custom set of rules, select the Upload Rules button. When uploading rules, be sure to select the desired append or replace option. Selecting Append new rules will add any rules after all existing rules. Replace all rules will overwrite any existing rules, without additional warning. The bulk rules file should be in tab-separated format with each line having the following fields: Match string, Match type (simple, regex or Zone), Action (map or ignore), Enabled

53 52 (0 or 1), Web application name (blank for ignore rules), and Description (optional). The format of the upload file is the same as the Full Export option available on the Rules page Building a rule The rule builder allows great flexibility in building a rule: Match Type allows you to select between a simple match or a SQLLike match. Simple matches to simple prefix matching, e.g. will match any URL under but will not match a subdomain like maps.google.com. In SQLLike, a specific character string is matched to a specified pattern. A pattern can include regular characters and wildcard characters. During pattern matching, regular characters must exactly match the characters specified in the character string. However, wildcard characters can be matched with arbitrary fragments of the character string. Please refer to Microsoft s documentation of LIKE Operator under T-SQL at Enter the appropriate URL or URL fragment in the Match String field, e.g., google.com. For Map rules, you are then presented with a list of web applications that have already been reported by Proton clients in the system, or you can enter a new name to represent a new web

54 53 application. Ignore rules are not associated with existing web applications and this option does not appear for Ignore rules. A specific rule can be enabled or disabled at any time by flipping the Enabled button. The default for a new rule is Disabled, so be sure to enable the rule prior to saving changes. Finally, enter descriptive text for any new rules (to help administrators identify rules) and select the Save changes button. Once saved, Rules will appear in the view: Editing a rule Existing rules can be modified by using the four buttons: From left to right, these buttons are Edit, Delete, Move up, and Move down. Edit will allow the administrator to modify the behavior of that particular rule using the same rule building UI used to create the rule. Delete will permanently delete the rule from the list. For rules that you wish to temporarily remove, it is recommended that you simply disable them (via the Edit button) so they can be easily restored when necessary. Rules are executed in order that they are listed, from top to bottom. As soon as a rule match is found for a specific web application, that rule takes affect and subsequent rules are ignored. For this reason, you should make sure that the rules are in the correct order; typically, from most specific (at the top) to most general (at the bottom). Use the Move up or Move down buttons on the rule list to re-order your rules.

55 Configuration Page The Configuration page allows Proton administrators and power users (but not standard users) to control client configuration settings (for heartbeat, data push, and inventory), data retention settings, cloud service definition settings, data collection options, and cloud file data collection (uploads and synced files) Client Configuration For the Client Configuration options, administrators can specify the frequency in which Proton clients will interact with the Proton server. Standard Proton user accounts will not be able to view or modify the settings on this page.

56 55 The available settings for Client Configuration are as follows. The BCMS is designed to scale to a large number of client systems, with higher Client Configuration values adding to the server s scalability. Value Description Proton Server Default Heartbeat interval Data push interval Inventory interval The interval at which clients poll the server (for new settings, rules, etc.) The interval at which clients push data to the server. The interval at which clients perform an inventory of installed ActiveX controls, Java versions, etc. 15 minutes 60 minutes 1440 minutes Data Retention BCMS and Proton offer the ability to define data retention policies to support organizational or regulatory compliance requirements, as well as serve to ensure organizations have the ability to limit unbounded growth of the Browsium Proton dataset. The default settings for BCMS are to automatically delete data on a rolling 90-day window, each night at midnight. The values can be adjusted by using the drop-down menu. Alternatively, data retention policies can be entirely disabled by switching the button to the left (off) position.

57 56 If no data retention policy is defined, the data set will continue to grow, eventually resulting in certain Proton reports taking an extended time to display Data Collection Options Data Collection Options provide the ability to control what data is collected from client systems. This provides the ability to turn on or off the collection of Java inventory (versions installed), Java usage details, ActiveX inventory (controls and versions installed), ActiveX usage details, page load performance metrics, server IP addresses, and script errors. All options are enabled by default.

58 57 The first four, Java inventory, Java usage, ActiveX inventory, and ActiveX usage,, are globally controlled, either on or off for all clients and web applications. The last four, performance analytics, server IP addresses, script errors and Query strings, have a global control with more granular control per web application. When enabled on the Configuration page, performance analytics and server IP address data collection defaults to enabled for each new web application. However, script errors and user accounts work differently. Query strings are always off by default. This is done in part to conserve space, as query strings can be large as well as often provide little specific value in dataset aggregates. In addition, the default settings help ensure no inadvertent privacy leakage should a poorly designed web application contain PII in the query string. When enabled on the Configuration Page, the per-web-application script errors setting will default to disabled and must be manually enabled for each web application. This is done to minimize extraneous and potentially private user data. In the case of script errors, many web applications generate harmless script errors in various browsers, so this feature should be turned on only for web applications where you re investigating specific error conditions reported by users or testers.

59 Users Page The Users page allows BCMS and Proton administrators to view and control the list of approved Proton user accounts. Proton User and Power User account types are not able to view this page. See section for details on the pages each account type has access to. User account requests are made by end users at Manager login screen see section Pending requests can be approved by clicking on the pending account name and then selecting the Approve button. Accounts can be promoted to administrator or power user status (or demoted to user status) by clicking on the account name and selecting User, Power User or Administrator. After the initial installation of BCMS, the first account created is automatically promoted to administrator status. Select a user account to modify it. Select Edit to change the user account type.

60 Password Policy Management Proton has a range of user account password policy management features, some configured by default (which can be modified) and others that are off by default but can be enabled by a Proton administrator. Password policies can only be configured in the Web.config file on the Proton server, not in Proton Manager. More on how to locate and edit the Web.config later in this section. Proton provides password and login policies for the following attributes: Session Timeout sets the number of minutes until an idle session of Proton Manager ends and displays the logon screen. The Web.config attribute is timeout, located in the system.web/authentication/forms section. The default value is 2880 minutes (2 days). Minimum Required Password Length sets the minimum length of the password The Web.config attribute is minrequiredpasswordlength and the default value is 8 characters. Minimum Required Non Alpha Numeric Characters sets the minimum number of special characters that the password must have. The Web.config attribute is minrequirednonalphanumericcharacters and the default value is 1 character. Maximum Invalid Password Attempts sets the maximum number of invalid password entries before the user s account is locked out. The Web.config attribute is maxinvalidpasswordattempts and the default value is (virtually unlimited). Password Attempt Window sets the number of minutes to keep track of invalid password attempts. After the window has expired, the number of invalid password attempts is reset. The Web.config attribute is passwordattemptwindow and the default value is 1. Password Expiration sets the number of days until a new password expires, forcing the user to change the password before logging on. The Web.config attribute is PasswordExpiration and there is no default value for this attribute. Password Strength Regular Expression sets a regular expression that every password must match. This can be used to set custom password policies. The Web.config attribute is passwordstrengthregularexpression and there is no default value for this attribute. You ll find a series of regular express examples in the Web.config file. An example using many of the above attributes is: minrequiredpasswordlength="12" minrequirednonalphanumericcharacters="1" passwordstrengthregularexpression="(?=(.*[a-z]){1,})(?=(.*\d){1,})"

61 60 The preceding example sets a password policy requiring that all passwords be at least 12 characters long and contain at least one upper-case letter, at least one digit, and at least one special character. When the passwordstrengthregularexpression attribute is used, you should set an InsecurePasswordMessage in the appsettings element in Web.config so that your users will know what the password requirements are. The default InsecurePasswordMessage is The password must be at least <minrequiredpasswordlength> characters long and contain at least <minrequirednonalphanumericcharacters> special character(s). To locate the Web.config file on your Proton server, navigate to C:\Program Files (x86)\browsium\proton\server\sites\server (or C:\Program Files\ if you re using a 32-bit Windows server). You ll find Web.config in this directory. It can be edited with any text editor, including Notepad. Familiarize yourself with the various sections of Web.config as the entries to control the password configuration outlined earlier in this section are found in various places inside the file. Once you ve made your edits to Web.config, save the file. IIS will automatically restart with the web service to immediately apply your new configuration. If you deploy Proton across a farm of load-balanced web servers, you ll need to make the same changes to Web.config on each server to ensure the password policies are enforced consistently. To simplify this process, change Web.config on one server and copy the file to the other servers in your server farm. Note: This guidance assumes all web servers are communicating with a single Proton database. Web.config is replaced when upgrading to a new version of BCMS. You ll need to save a copy of your Web.config file (or keep a separate document with the edits you have made) before upgrading and apply your custom settings to the new file. You should not assume that the old Web.config file will work on the new version of Proton as other aspects of Web.config may have changed to support new features in Proton.

62 Privacy Page BCMS and Proton include a Privacy mode to comply with certain international regulations on tracking specific activity to specific users. When Privacy is enabled, all information that can be used to trace user activity back to an individual will be removed. All personally identifiable information from all client user accounts that meet any of the criteria established in the Privacy settings will be removed. Privacy is disabled by default. To enable Privacy for all client user accounts, select the Privacy enabled for all users button. Then select the scope either Anonymize users to only anonymize user names and IP addresses, or Anonymize users and machines to also anonymize machine names. Then Save Changes to commit the Privacy setting. This will anonymize all client user accounts, IP addresses, and (optionally) machine names for all activity from this point forward. It will not retroactively anonymize any prior activity. If you ve already collected activity data, it will remain in the database and be visible on reports until that data is purged by the data retention policy settings.

63 62 Anonymized activity data will be evident in three fields: User, IP Address, and (optionally) Machine. In the example below, the user who accessed has been anonymized to Anonymous155. (The next anonymized user seen by this Proton server will be Anonymous156.) The IP Address has also been anonymized, zeroing out the last octet. Machine anonymization is not enabled in this example. Maintaining unique anonymized user and machine names is key to Proton s ability to track access counts and other data for each web application used by your organization. So while the activity can t be tracked to an individual user, it can be correlated with other data to help you to make informed decisions when managing your web browser and web application environment. To enable more granular control over which client user accounts are anonymized on your Proton server, select the Privacy enabled for some users button. This expands the controls available on the privacy page.

64 63 You now have the ability to limit the privacy settings by Organizational Unit, Active Directory Sites, or IP Address ranges. You can read from existing data to add OU or AD Sites filtering, or add new entries based on your knowledge of your Active Directory structure. You can add multiple IP address ranges by clicking the Add Range button.

65 Diagnostics Page The Diagnostics page provides administrators with information on the internal health of the Proton system and processes. This data is useful for administrators to review for troubleshooting, and may be required when contacting Browsium support. The System Control value on the diagnostics page is a global setting to enable or disable BCMS. If set to Disable, both the BCMS and Proton systems will not work as expected. Value Contact the Cloud Licensing Service Data retention Expire seat reservations Process incoming activities Rule mapping Description The BCMS server routinely connects to the Browsium Cloud Licensing Service to validate the licenses assigned to your organization. No company or system configuration information is transmitted. This connection is done to ensure licenses remain valid and seat counts are properly implemented. The data retention process is set by default to run at midnight each night. This item shows the status of the data retention enforcement and cleanup process. Client machines that do not report or connect to the BCMS server on a regular basis will have their license seat reservations expired. This is done to ensure retired systems are removed from license seat counts, as well as ensure accurate accounting is maintained on a regular basis. Proton performs regular indexing and aggregation of incoming client data. This item shows if the aggregation process is performing properly or if maintenance or intervention is needed to correct a system error condition. As needed, customers can modify and re-sort the Proton rules. When the rule structure is modified, Proton processes the new ordering and re-indexes (as needed) the dataset. This value shows the status and health of that process. When an error condition occurs, the task switches to status Error. The task will remain in status Error until the task runs again without triggering an error. However, the Last Error Message will remain indefinitely, so BCMS and Proton administrators can see the most recent error, even if status returns to OK. The Last Error Message can be cleared from the Diagnostics display via the

66 65 green Clear last error button. However, all errors are written to the Browsium log in Event Viewer so you can retain a copy for future troubleshooting. When a task has an active error, you ll also see the status on the Proton Dashboard in the System Status section.

67 66 Section Four Proton Tutorial In this section, you will learn: Best practices for configuring your Proton Server

68 67 4. Tutorial 4.1. Connecting to Proton Manager for the First Time Congratulations on getting setup and ready to go with BCMS and Proton. While Proton was designed to be easy to setup and use, this section can help answer questions that may come up when using Proton the first time. This section focuses on getting started with the Proton features in the Browsium Client Manager, including finding the server URL, creating user accounts, and other basic elements on the administrative side of the system Connecting to the Proton Manager Accessing the administrative console and reporting screens of the Proton Manager is easy. All you need is a modern browser (latest Internet Explorer, Edge Chrome, or Firefox recommended), the BCMS URL (configured during setup) and lastly, network access to your BCMS (Proton) Server to access your server data. During installation, an Internet shortcut (.lnk file) is created on the server to enable easy access to the Browsium Client Manager and Proton features on your server. This shortcut connects to Browsium Client Manager while setting the managed BCMS to the one for your organization. To access the Browsium Client Manager from other systems, or to provide access to other administrators, simply provide the shortcut.lnk file. While.lnk files are very helpful when accessing a web server with a complex URL, systems typically block these files. Therefore, sharing them with other administrators of your Proton Server can be difficult. The following paragraph provides an alternative for sharing this URL. Another option for sharing the Proton Manager URL with other administrators is to provide the shortcut URL itself rather than the.lnk file. The URL is: where SERVERNAME is the machine name (or Fully Qualified Domain Name) of the Windows system where you installed Proton and PORT is 443 for a default BCMS installation. If you are using port 443, you can leave PORT blank as 443 is the default port for all HTTPS traffic. SERVERNAME and PORT are referenced in the following sections using the same definitions used above.

69 Self-Signed Certificate Errors It is possible to install BCMS using a self-signed certificate used to encrypt communication to and from the server. If a self-signed certificate was chosen during setup, you may require a few extra steps to ensure proper client connectivity. During the secure connection process with Browsium Client Manager may trigger certain browser error notifications if the Proton Server was installed with a self-signed certificate and the Manager is being accessed from a system not running Proton Server. Browsium recommends the use of certificates signed by a known and trusted certificate authorities. The following error message is generated by the Browsium Client Manager to validate the secure connection to the Proton Server when the Proton Server is using a self-signed certificate. Click Verify to complete the validation and then log into the Proton Manager. Other certificate errors you may experience only impact connections to the Browsium Client Manager. The errors can be safely bypassed without creating any security exposure or risk to the organization once the certificate details have been verified as indicated below. Internet Explorer users may see this certificate error if the certificate is self-signed:

70 69 Click the More Information link to verify the URL (IP address or name), then click Continue to this website if the details are correct. When viewed with Google Chrome, the certificate error screen looks like this: Verify the URL (IP address or name) is the right location, then click the Proceed link to continue. Users should only see these certificate errors once for each browsing session when connecting to the Browsium Client Manager.

71 Creating the First Account Once connected to Browsium Client Manager, user accounts are required for access control. Administrator, Power User, and Standard User account types are available. The first account created will be an Administrator. Select the Create an account button the first time you access Browsium Client Manager. Browsium Client Manager accounts are stored in Proton database and self-contained. Single Sign-On (SSO) access is not supported at this time. Contact Support for more information. Because BCMS are integrated, and BCMS must be setup first, the first account may have already been created.

72 71 Then create a username and password, using a well-formed address for the username and a strong password. Then select Register. The default Proton password policy enforces a minimum of 8 characters, including 1 special character. Supported special characters are ] [? / < ~ # $ % ^ & * ( ) + = } : " ; ', > { To change the defaults and enforce stricter password policies, including account lockout and password expiration, see Password Policy Management in the Users Page section. Once your account is created, you ll be able to log in directly with the credentials you created.

73 72 Additional accounts can be created using this same screen and permission levels are managed on the Users page in Proton Manager Exporting Proton Report Data Views The data and insights Proton can provide an organization have a broad set of uses and value to numerous teams. To enable easier sharing or integration of the data sets into other applications and existing internal reports, Proton offers several export options of the currently active view: - Copy to Clipboard - Save as CSV - Print Any of these export options can be accessed by clicking the Page Export button in the Export Bar interface to the right of the Search box. You may also export the entire dataset for the current report to CSV only using the Full Export button. Exported data will be in the same layout and format as the on-screen report. Column headers, ordering and labeling is preserved in the export. CSV exported data contain a header row defining the columns. The Copy (to clipboard) option contains all text, but formatting is lost due to limitations of the copy/paste process. The Export View feature is available on any of the Client, Activity and Rules pages.

74 Creating Rules Once Browsium Proton has been activated on your server, and you ve installed Browsium Client on a few client PCs (configured to communicate with your BCMS via the ConfigurationServerURL registry key), you can begin creating rules. Rules serve two functions: 1) Map rules govern web application mappings to make it easier to combine and track accesses to specific web applications. 2) Ignore rules allow you to choose sites to ignore, so they don t appear in activity reports and are no longer sent from Proton Clients to the Proton Server Create and Test a Map Rule Map rules are very useful if you have web applications that have complex or non-obvious URLs. Map rules allow you to create a friendly name for those URLs so they re much easier to read and analyze in Proton s activity reports. For this example, we have identified a website, yourang.us, which has a number of web applications, each performing a different function. YouRang also has a few web applications that use non-continuous URLs that is, the same application has a few unique URLs (/order_phone.htm and /purchase_phone.htm) that cannot be easily string-matched to aggregate them into a single view of usage of that application. Map rules will be very helpful in turning a variety of end user accesses of this section of the YouRang website into meaningful information. To create the map rules needed for the YouRang phone ordering application, use the following steps: 1. Visit the Rules node of the Proton Manager 2. Select New Rule to create a new rule.

75 74 3. The New Rule dialog pops up with its default values. 4. Keep the default values for Action: Map and Match Type: Simple, and enter yourang.us/order_phone.htm (without quotes) as the Match String. Then choose New web application for the Map to Web Application value and enter YouRang Order Phone with an appropriate description. Enable the rule, and add a description for the rule.

76 75 5. Next, repeat the steps above for the purchase_phone.php page, assigning it to the web application YouRang Order Phone created in the prior step. 6. We now have two map rules, aggregating all accesses to yourang.us/order_phone.htm and yourang.us/purchase_phone.php to a single web application called YouRang Order Phone. 7. Viewing the Activity node and filtering the view to the Order Phone application shows us the aggregate results, at both the summary and detail level.

77 Create and Test an Ignore Rule Ignore rules are very useful if you have users accessing websites that you don t want to track in Proton (such as social media or e-commerce sites though many organizations would love to know how much of that activity is happening during work hours). Another common scenario for ignore rules is to ignore accesses to the Browsium Client Manager as that traffic can dwarf accesses to other web applications if you re accessing the Manager multiple times a day to view reports or monitor Proton tracking activity in your organization. For this example, we will create an ignore rule for our Browsium Client Manager using the following steps: 1. First, let s have a look at the traffic to a Browsium Client Manager (running at protondemo.browsium.com) without an ignore rule. We can do this by searching for the string proton in the Activity page. We see a single access by 1 user. 2. Now let s create some ignore rules. Select New Rule to create a new rule.

78 77 3. The New Rule dialog pops up with its default values. 4. Next we ll change the Action from the default Map to Ignore. We ll leave Match Type as Simple. For the Match String, enter the server URL. For this example, we ll use protondemo.browsium.com. We ll set the rule to Enabled and give our rule a description.

79 78 5. After saving changes, we visit our Activity node and again search for activity containing the text proton. No results are found, thanks to our ignore rule. Ignore rules not only suppress activity from the Activity reports, but they also instruct Proton Clients to no longer send activity to the server that matches the ignore rule. It s important to note that data already stored in the BCMS is not deleted by an ignore rule; it s simply invisible to reports.

80 79 Appendix A Appendix A: Troubleshooting In this section you will learn: How to recognize Issues with a Proton configuration What to do when Proton is not working as expected

81 80 A. Troubleshooting A.1. Browsium Client fails to report data There are a few reasons Browsium Client may fail to report usage data to the Proton server: Check to ensure the Browsium Client browser extensions are enabled Check to ensure the Proton Server URL is reachable from the PC running the Browsium Client When the Browsium Client is unable to contact the server, data will be stored for a period until connectivity is restored. If the connection is disrupted for an extended period, older Proton data will be overwritten in order to limit the cache size. This value is stored in the registry the value MaxClientCacheSizeInMegabytes and the default is 128. A.2. Browsium Client Management Server appears to fail installation The BCMS installer is designed to report reasons for an installation failure, but if an existing IIS Site with a duplicate name was present during BCMS Manager setup, the IIS portion of the BCMS environment will fail to install correctly. A.3. Proton not working with Microsoft Edge Microsoft Egde must be run on a domain joined machine, under a domain user account and side loading of extensions enabled. See section for more information.