Ekran System v. 6.2 Program Overview
Contents About the Program Login Ekran Server & Management Tool Notifying Users about Being Database Management Monitored Licensing User Blocking Client Installation & Update Viewing Sessions Monitoring Parameters Alerts Offline Client Detection ( Lost USB Monitoring Clients) Dashboards Client Protection Interactive Monitoring Advanced User Authentication Reports Two-Factor Authentication Application Customization Privileged Account and Session Health Monitoring Management Administrator s Approval on Page 2 of 128
About the Program Page 3 of 128
About the Program Smart user activity video recording system. Privileged Identity Management Employee Work Control Privileged Password and Session Management Cost Saver on the Market Ekran System allows creating indexed video records of all concurrent Windows, Citrix, and Linux terminal sessions on your servers and record remote and local sessions on workstations, including macos. Are you interested in your company's security? Do you want to know what your employees do during their working hours? Do you want to control sensitive information use? PASM helps you to provide privileged access to critical assets and meet compliance requirements by securing, managing and monitoring privileged accounts and access. Ekran System provides all popular segment features while offering much more beneficial pricing than ObserveIT or Citrix Smart Auditor. Page 4 of 128
About the Program Ekran System is an affordable user monitoring solution for enhanced cyber security. You can record all terminal, remote, and local user sessions and alert security personnel to suspicious events. Ekran System Components Ekran Management Tool Ekran Server Ekran Clients Windows/macOS/Linux/Citrix GUI part used for system management & session viewing Main component used for storing data obtained from Client computers Components installed on the target computer to monitor user activity and send it to the Server Page 5 of 128
Ekran System Structure Page 6 of 128
High Availability Mode (Enterprise Edition) The High Availability mode provides a high level of operational performance and balances the load of sent data, minimizing downtime and service interruptions. Page 7 of 128
Disaster Recovery Mode The Disaster Recovery mode allows you to configure and deploy Ekran System in such a way that if the Ekran Server stops functioning for any reason, another Ekran Server instance can replace it without data loss and reinstallation of the system. Page 8 of 128
Single-Tenant/Multi-Tenant Mode The Multi-tenant mode allows multiple strongly isolated tenants to operate in Ekran System environment. Data of each tenant is independent and not accessible to other tenants. Page 9 of 128
Ekran Server & Management Tool User management, permissions, Active Directory Integration, Management Tool settings Page 10 of 128
Management Tool You can manage the whole system via the Management Tool in your browser. Page 11 of 128
Tenant Management Ekran System has Single-tenant and Multi-tenant modes. The Single-tenant mode is selected by default. In this mode, all users have access to all Clients and settings according to their permissions. In the Multi tenant mode all tenant users have access to their tenant Clients, but they have no access to other tenants Clients, configurations, alerts, reports, etc. You can switch to the Multi-tenant mode any time. Page 12 of 128
User Management & Permissions Create two types of users: Internal or Active Directory (Windows domain users/groups). Use groups for easier user management. Define permissions for users. Page 13 of 128
Active Directory Integration Integration with Active Directory allows you to establish the domain trusts with multiple domains. Page 14 of 128
Active Directory Integration Integration with Active Directory allows you to do the following: Add users & user groups from trusted domains to allow them to access the Management Tool and Client machines with enabled Forced User Authentication. Create alerts for domain groups to quickly respond to suspicious user activity on the Client computers belonging to trusted domains. Page 15 of 128
Management Tool Log Audit all user activities performed in the Management Tool via the Management Tool Log with the detailed information on all changes. Page 16 of 128
Database Management Page 17 of 128
Database Configuration Page 18 of 128
Database Cleanup One-Time Cleanup Scheduled Cleanup Page 19 of 128
Database Archiving (Enterprise Edition) Archive and delete the old monitored data from the Database to not run out of space on the Server computer and to save the monitored data in a secure storage. Page 20 of 128
Database Archiving (Enterprise Edition) You can view the archived sessions from your archived database in the Session Viewer and perform searches in them in a usual way at any time. Page 21 of 128
Isolating Database from Clients (Enterprise Edition) You can disconnect all Clients from the database and send them offline so that you can fix issues with the database, run database cleanup and maintenance without stopping the Ekran Server. Once database work is restored, you can return all Clients online in one click. Page 22 of 128
SIEM Integration Ekran System integrates with your SIEM system using log files of the monitored events. Page 23 of 128
Advanced SIEM Integration Get access to the Ekran System alert events and monitored data by creating a separate log file in one of the following formats: Common Event Format (CEF): (can be viewed and analyzed by the Splunk or ArcSight monitoring software) Log Event Extended Format (LEEF): (can be viewed and analyzed by the IBM QRadar monitoring software) Page 24 of 128
Licensing Types of Licenses & Serial Key Management Page 25 of 128
Licensing Ekran System is licensed by the number of Ekran Clients, endpoints to be monitored. All management components, including Server and Management Tool, are provided for free with any deployment. Types of Ekran Client licenses: Terminal Server Client license Infrastructure Server Client license Cloud Server Client license Workstation Client license Linux / UNIX Server Client license Page 26 of 128
Licensing Page 27 of 128
Serial Key & License Management Request a trial serial key for 30 days to deploy the system and review its basic features with a restriction of 3 Workstation Client licenses, 3 Linux/UNIX Server Client licenses, and 1 Terminal Server Client license. To work with Ekran System for a longer period, license it by activating the serial keys on the computer with the installed Ekran Server. You can use either permanent keys, or update and support keys. Page 28 of 128
Enterprise Key Activate Enterprise serial key to get exclusive access to a set of additional, valuable features of Enterprise Edition of Ekran System. Page 29 of 128
Unique Enterprise Edition Features Features available only for Enterprise Edition: High Availability Multi-tenant Privileged Account and Session management Offline Clients detection ( Lost Clients) Integration with ticketing system System Health Monitoring Server Resource Monitoring Database archiving Advanced SIEM Integration IP Filtering Page 30 of 128
Client Installation & Update Page 31 of 128
Installing Ekran Clients Convenient Ekran Client installation: Local: o Linux Clients (via tar.gz file) o macos Clients (via tar.gz file) o Windows Clients using installation file with default parameters using generated package with customized parameters Remote (for Windows Clients) Remote Installation Select computers to install Clients on Customize installation parameters The Clients are successfully installed! Page 32 of 128
Target Computers for Remote Installation Scan your local computer network Define a range of IP addresses to search the target computers Simply enter target computer names Page 33 of 128
Updating Ekran Clients When Ekran Server is updated to a newer version, all Clients are automatically updated to the same version after their first connection to the Server. If you want to personally supervise the update process of target Clients, you can disable the Update Client automatically option on them. Page 34 of 128
Monitoring Parameters Page 35 of 128
Client Monitoring The screen captures the Client sends are stored in the form of deltas (differences between a newer recorded screen capture and an older one) to minimize storage space. Recorded information is saved in an easy-to-review and easy-tosearch form: The name of the launched application The title of the active window Entered URL Text entered via user s keyboard (keystrokes) Clipboard text data (copied and pasted text) Commands executed in Linux (both from user input & by running the scripts) The information on plugged-in USB devices Page 36 of 128
User Activity Recording Ekran Client user activity recording is event-triggered by default. You can configure Windows and macos Clients either to screenshot active window only or to record user activity without taking screenshots. Page 37 of 128
URL Monitoring Ekran Client monitors URLs entered in web browsers. You can configure the Client to monitor full URLs or domains of top and second level only. Page 38 of 128
Keystroke Logging To ensure the GDPR compliance, all logged keystrokes are hidden, but you can perform searches within them and create alerts to be triggered when specific words are typed. Also, keystrokes can be filtered, which allows you to reduce the amount of information received from the Windows Client and grant that there is no privacy violation by defining applications where keystrokes will be monitored. Page 39 of 128
Keyword-Triggered Monitoring You can configure Ekran Clients to start monitoring and creating screen captures only after detecting the defined keywords entered by the user in specified applications. Page 40 of 128
Clipboard Monitoring Ekran Client captures all text data, which has been copied or cut and then pasted into documents, files, applications, browser address bar, etc. on the Windows Client machines. You can adjust an alert to be triggered whenever the user copies or cuts information and pastes it. Page 41 of 128
Application Filtering Ekran System allows you to define the filtering rules for websites/applications to adjust the amount of monitored data and exclude the areas where private information can be observed to comply with corporate policy rules and country regulations related to user privacy. Page 42 of 128
Monitoring Time Filtering In addition to application filtering rules, you can define monitoring time filtering ones. By selecting certain days of the week and defining specific hours, you can establish the bounds in which Ekran Clients will record all user activity. Page 43 of 128
IP Filtering Additionally, you can filter out sessions from certain remote IP addresses or monitor only sessions from certain IP addresses. Page 44 of 128
Privileged User Monitoring Monitor the activity of users logging in under privileged user accounts. Page 45 of 128
Client Group Settings You can define the settings for a Client Group and then apply them to the Client to save your time. Page 46 of 128
Offline Client Detection ( Lost Clients) Page 47 of 128
Offline Clients Detection ( Lost Clients) Offline Client detection will help you to timely detect Clients that have stopped transmitting monitoring data. Just define the time period after which the Clients will be considered lost and get notified about such incidents. Page 48 of 128
Viewing Offline Clients ( Lost Clients) You can view all Clients that are offline for more than specified time period on the Offline Clients page. Page 49 of 128
Client Protection Page 50 of 128
Protected Mode Ekran System allows you to protect Windows Clients and their data by enabling the Protected Mode. The usage of Protected Mode has the following advantages: Prevention of Client uninstallation. Prevention of stopping Client processes. Prevention of editing Client system files and logs. Prevention of editing Client settings in the registry of the Client computer. Prevention of modification, removal, and renaming of Client files. Page 51 of 128
Client Uninstallation Users, including privileged ones, are unable to stop the Client working on their machines, as well as remove the Client locally without the Administrator assistance. Only Ekran System Administrator knows the uninstallation key defined prior to Client installation and necessary for local removal. Page 52 of 128
Advanced User Authentication Page 53 of 128
Advanced User Authentication Advanced user authentication allows you to achieve two goals: Monitor users activity on the computer when multiple users use the same credentials to log in. Improve your security by limiting the access to the specific users who know secondary authentication credentials. Page 54 of 128
Advanced User Authentication (Windows Clients) The Ekran System Client requests entering credentials before allowing a user to work with Windows OS. Page 55 of 128
One-Time Password (Windows Clients) Enterprise Edition Ekran System provides the administrator with a unique ability to generate a one-time password for a user log in to the Client computer with Windows OS. Page 56 of 128
One-Time Password (Windows Clients) The user can request a one-time password directly from the secondary authentication window displayed on login to Windows OS. Page 57 of 128
Advanced User Authentication (Linux Clients) The Ekran System Client requests entering credentials before allowing a user to work with the terminal on Linux Client machines. Page 58 of 128
Two-Factor Authentication Page 59 of 128
Two-Factor Authentication Two-factor authentication allows you to enable an extra layer of security to better protect the critical endpoints in your network. Page 60 of 128
Two-Factor Authentication Add users who will be allowed to log into the Windows machines with installed Clients using time-based one-time passwords (TOTP) generated in the TOTP mobile applications. Page 61 of 128
Two-Factor Authentication The Ekran System Client prompts the user to enter a TOTP to start working with the system. Page 62 of 128
Privileged Account and Session Management Page 63 of 128
Privilege Account and Session Management (PASM) When deploying Ekran System on a jump server, you can use additional access management toolset, while for further RDP connections from this server you can use password vault and manage the list of accounts allowed to access the selected production servers. Page 64 of 128
Password Vault The account credentials are automatically generated, encrypted and stored in SQL Password Vault. To enhance data access security, privileged user is not able to access specified endpoints after the expiration date. Page 65 of 128
Adding Privileged Account Define a privileged user to give access to, computers to be accessed, and the privileged account settings. Page 66 of 128
Logging in under Privileged Account You can log in under the privileged account using the Ekran System Remote Access. Page 67 of 128
Administrator s Approval on Login Page 68 of 128
Administrator s Approval on Login Administrator s approval on login allows you to better protect the Client machines in your network from undesired access. Page 69 of 128
Administrator s Approval on Login Add users whose access to the Client machines needs to be restricted. Page 70 of 128
Administrator s Approval on Login When the restricted user logs into the Client machine, the Client blocks the desktop and sends the user s access request to the administrator. Page 71 of 128
Administrator s Approval on Login After the administrator confirms the user s access request, the user is allowed to start working with the system. Page 72 of 128
Notifying Users about Being Monitored Page 73 of 128
Notifying Users about Being Monitored To follow the security policy of your company or your country regulations, you can: Enable displaying an additional message on user logging in to notify the user that his or her work is being monitored. Display a Client tray icon with the notification about monitoring to the user. Page 74 of 128
Notifying Users about Being Monitored Require the users to enter the comments to the additional message displayed on their login to the Client computers. Page 75 of 128
Notifying Users about Being Monitored Require the user to enter a valid ticket number created in the integrated ticketing system to start working with the Client machine. Page 76 of 128
User Blocking Page 77 of 128
User Blocking Overview Ekran System allows you to block users performing potentially harmful and forbidden actions on computers with Windows OS with Ekran Clients installed on them. Users can be blocked manually from both Live and Finished sessions, or automatically when they perform an action that triggers a specific alert. Page 78 of 128
User Blocking Overview The user desktop is blocked, and after the defined time interval the user is forcibly logged out. If the blocked user tries to log in to the Client computer, the system does not allow him/her to do so. Page 79 of 128
Viewing Blocked User List The Blocked User List contains information on when, and why the user was blocked. To allow the users access to the Client Computer, remove them from the list. Page 80 of 128
Viewing Sessions Page 81 of 128
Searching Data in Session List Ekran System Management Tool allows searching in the recorded sessions. Search is performed by different parameters: For Windows Clients: active window title, application name, user name, Client name, visited URL, clipboard text data, user s comment to the additional message, ticket number, USB device information. For macos Clients: active window title, application name, user name, Client name, visited URL. For Linux Clients: commands, command parameters, and command output. Page 82 of 128
Viewing Live Session Ekran System allows you to perform monitoring of user activity in real time. You can connect to a Live session and observe the activities a user is performing at the given moment. Page 83 of 128
Magnifying Glass You can enlarge certain parts of the video in the Session Player by using the Magnifying Glass. Page 84 of 128
Forensic Export With Ekran System Forensic Export, you can: Export a monitored session or its part to a securely encrypted file. Investigate the recorded user activity in the in-built offline session viewer. Present evidence in forensic format to the third parties. Page 85 of 128
Alerts Page 86 of 128
Setting Up Alerts Ekran System allows you to enable quick incident response using alert notifications: Set up alerts about suspicious user activity on the Client computers. Specify individuals to receive instant alert notifications via email or in the Tray Notifications application. Page 87 of 128
Alert Actions You can set the alert to: Display a warning message to the user when the alert is triggered. (The message can be edited) Block the user. Forcibly stop the application. Page 88 of 128
Default Alerts Ekran System contains a set of default alerts prepared by the vendor security experts. They will alarm you about data leakage, potentially fraudulent, illicit, or work-unrelated activities. Page 89 of 128
Alerts in Session Player Monitored data associated with alert events is highlighted in different colors in the Session Player according to the alert risk level. Page 90 of 128
Alerts in Alert Viewer You can view detailed information on all alert events as well as screen captures associated with them in a special viewer. Page 91 of 128
Receiving Alerts Receive alert notifications in real time, review them in the Ekran System Tray Notifications journal, and open the session with the alert-related data in the Session Player. Page 92 of 128
USB Monitoring Page 93 of 128
USB Monitoring Overview Ekran System provides two types of monitoring USB devices plugged into the Windows Client computer: USB-based storage monitoring, to view information on the devices detected by Windows as mass storage and receive alert notifications. Kernel-level USB monitoring, for an in-depth analysis of pluggedin devices and their blocking. Page 94 of 128
Setting Up Kernel-level USB Rules Ekran System can detect USB devices connected to a computer, alert you on device plugging in, and block their usage (either all devices of a certain class or all except the allowed devices) on a Client computer. Page 95 of 128
USB-Based Storage Monitoring USB-based storages are automatically detected on being plugged in. Page 96 of 128
Kernel-Level USB Monitoring Screen captures created on USB devices being plugged in or blocked are highlighted in the Session Viewer. Page 97 of 128
Dashboards Page 98 of 128
Dashboards Overview The dashboards offer a convenient real-time view of the most useful data grouped in one place. Customize the dashboards on the Management Tool Home page by adjusting their look and settings. Page 99 of 128
Dashboard Types There are four main types of Ekran System dashboards: System State Dashboards o Licenses o Clients o Database Storage Usage Monitoring Dashboards o Recent Alerts o Latest Live Sessions Threat Detection Dashboards o Sessions out of Work Hours o Rarely Used Computers o Rarely Used Logins Server Resource Monitoring o CPU Usage o Memory Usage o Database State Page 100 of 128
System State Dashboards Clients Database Storage Usage Licenses Page 101 of 128
Monitoring Dashboards Recent Alerts Latest Live Sessions Page 102 of 128
Threat Detection Dashboards Rarely Used Computers Rarely Used Logins Sessions out of Work Hours Page 103 of 128
Server Resource Monitoring CPU Usage Memory Usage Database State Page 104 of 128
Interactive Monitoring Page 105 of 128
Interactive Monitoring Overview You can filter out data by three parameters: Who: filter by a specific user logged into the Client computer. Where: filter by a specific Client. When: filter by the time period. Additionally, you can set the order of bars being displayed, using the Applications and URLs filters. Data is displayed in the form of two column charts (Application Monitoring chart and URL Monitoring chart). To see the list of application/website entries, click on the column with the application/website name. Page 106 of 128
Application Monitoring Chart This chart provides information on the application usage frequency. You can also use this chart to analyze information on the most and least used applications and detect any threats and suspicious activity on investigated computers. Page 107 of 128
URL Monitoring Chart This chart provides information on the website visiting frequency. You can also use this chart to analyze information on the most and least visited websites and detect potentially harmful activity on investigated computers. Page 108 of 128
Reports Page 109 of 128
Reports & Statistics Ekran System Reports provide the full overview of the time spent in applications and on websites visited on the user s machine. Generate a highly customizable report ad-hoc or schedule sending reports to your email on a daily, weekly, or monthly basis. The reported activity can include alerts, launched applications, visited websites, plugged-in/blocked USB devices, and executed Linux commands. Scheduled Reports Page 110 of 128
Reports & Statistics The reports can be generated manually at any time for any time period. Manual Report Generation Page 111 of 128
Report Types Activity summary report Activity pie chart report Activity chart report Page 112 of 128
Report Types User statistics report Clipboard grid report Page 113 of 128
Report Types Session grid report Sessions out of work hours grid report Page 114 of 128
Report Types Detailed Activity report User daily activity grid report Page 115 of 128
Report Types Alert grid report Page 116 of 128
Report Types URL summary report URL pie chart report URL chart report Page 117 of 128
Report Types USB storage grid report Kernel-level USB storage grid report Page 118 of 128
Report Types In the Linux grid report, you can view all exec* and sudo commands executed on Linux Client computers. Linux grid report Page 119 of 128
Application Customization Page 120 of 128
Date and Time Format Date&Time Format configuration allows you to define the date and time format for the Management Tool and the Server. Page 121 of 128
Custom Logo on Client Notifications Custom Logo settings allow you to enable using custom graphic files instead of the default logo on the Client notifications during secondary authentication, user blocking, etc. Page 122 of 128
Report Customization Custom Reports settings allow you to enable using custom graphic file instead of the default logo in the reports. Also, you can add the header and footer text in the reports. Page 123 of 128
Custom Email Subjects Custom Email Subjects settings allow you to define the subjects to be used in email notifications sent by Ekran System. Page 124 of 128
Health Monitoring Page 125 of 128
System Health Monitoring System Health Monitoring allows you to get detailed information about the database storage usage and errors occurring in Ekran System which helps to monitor the system health and react to any problems in time. Page 126 of 128
Server Resource Monitoring Ekran System allows you to see the resource usage by the Ekran System Server process at the moment: CPU Usage by Server process Memory Usage by Server process Database State Page 127 of 128
Visit us online: www.ekransystem.com Page 128 of 128