ObserveIT software provides IT and Security Managers a full video playback of any user activity on servers and organization PC's. ObseveIT is the first software that records 24X7 all users session and that true makes sense! The reason is that ObserveIT captures not only the on-screen user activity in a video format but also collected textual metadata that describes what is seen on screen. The result is a searchable video format that provides that following benefits:
- No need to replay an entire recording to find what your looking for
- Each recording is broken down into chapters (similar to DVD chapters) that shows each resource the user accessed (window title, application name, files name, databases and more)
- Google-like searching of the recorded content
- Low storage requirements
- ObserveIT does not record idle time (user reading, thinking…) therefore it requires only 100 GB of data storage per year to record a typical environment with 1000 servers
The new release 4.08 includes both the free and enterprise version.
ObserveIT Xpress edition is a free product and is limited in its capabilities in comparison with the Pro edition. For example, it can only be used to record a maximum number of 5 Agents, there are no configuration options available (i.e. record all applications, all the time, for all users), and replaying of recorded sessions is limited to the last 24 hours.
The Xpress edition can be downloaded from:http://www.observeit-sys.com/ObserveIT-Express.asp
ObserveIT Pro Edition is designed for enterprise-wide deployments. It is capable of integrating with 3rd-party auditing and monitoring tools in order to provide almost real-time alerting of user actions. It can be used in conjunction with external LDAP-based databases to provide identification services, and the broad list of configuration functionalities makes it a truly formidable recording and auditing solution.
A 15 days evaluation of the enterprise version can be downloaded from:http://www.observeit-sys.com/download.asp
In its new version there are various changes that have been made to the product’s user interface (UI) and functionality. Some of these changes and features include:
- “On-Air” real time replay of active sessions
- Administrator-initiated server posted notes with acknowledgment and reply functionality
- Granular access control to session playback
- Ability to exclude specific users from being recorded
- Faster Identification Services pop-up window
- Indication of the length of user sessions
A free evaluation version can be downloaded from:http://www.observeit-sys.com/download.asp
“On-Air” real time replay of active sessions
One of the most exciting features of ObserveIT is the new “On-Air” feature which allows the administrator or auditors to clearly see that the user session is still active on that server, and if clicked upon, it will launch the Slide Viewer in a real time refresh mode. In this mode, any action performed by the logged on user in the replayed session will be instantly transmitted to the slide viewer, making it possible to view the user actions in real time.
Figure 2: “On-Air” icon
Administrator-initiated server posted notes with acknowledgment and reply functions
In this version we’ve made it possible for the ObserveIT administrator to create one or more messages that will be displayed when a user logs on to the monitored server (agent). This feature enables the administrator to send warnings, information or other types of text to the users that are about to log on to the monitored servers, and is useful in cases of multiple administrators or remote vendors accessing the same machines, ongoing project notifications or other types of one-way communication.
Figure 3: Creating Server Messages
The message(s) will be displayed on the monitored servers’ desktops right after the user logs in. The message(s) window cannot be moved, minimized or resized, and thus forces the user to read it. Each message has an “Acknowledge” check-box that the user must click on in order to acknowledge it, and either move to the next message or close the window in case there was just one message. The user can also move back and re-read the message(s) in case of multiple messages.
Figure 4: Server Messages
While messages are most likely viewed as one-way communication, another feature of the administrator-initiated message is the ability of the receiving user to enter a reply text which will be displayed in the Server or User Diary. This makes it possible for the user or remote vendor to provide textual information back to the ObserveIT administrator or auditor, and have that information recorded inside the ObserveIT database.
ObserveIT provides an easy to use interface for creating, editing, deleting or viewing these messages and replies. Messages can have different characteristics such as the display interval, duration, server focus and more.
Figure 5: Viewing Server Messages
Granular access control to session playback
ObserveIT uses the concept of Console Users. These users can have one of two types of roles, allowing the ObserveIT administrator flexibility when there is need for more than one administrator role, or when there are several separate auditors that need access to specific groups of servers based upon their role in the company
- An Administrator - role has full control over all the management features of ObserveIT. An Administrator can make changes to the ObserveIT configuration, and is allowed to view all session recordings.
- A View-Only Administrator - role can view session recordings, but cannot gain access to any ObserveIT configuration option. These users can be granted access to certain groups of servers, depending on their job function and security clearance.
The new version of ObserveIT allows the administrator to grant permissions for auditors to replay sessions and be exposed only to information that was generated by specific users. This way, the auditor can only view specific recorded sessions and will not be exposed to potentially sensitive information that was recorded on other sessions that were created by users outside the scope of that auditor’s responsibility.
Figure 6: Granting permissions for specific users
Ability to exclude specific users from being recorded
By using Server Policies (which are a collection of configuration settings allowing the administrator flexibility in configuring the recording options, identification services and other Agent settings), it is possible to configure the recording policy to record all logged on users (the default behavior), only record specific users excluding any user not specifically entered, or record all users excluding one or more users.
This makes it possible for the ObserveIT administrator to configure the system not to record particular users that need not be monitored.
This setting is very flexible and can be changed in matter of seconds.
Figure 7: Excluded Users
Faster Identification Services pop-up window
With Identification Services enabled, ObserveIT can be configured to require users that logon to the monitored servers to identify themselves with a secondary ObserveIT logon prompt. These users are also known as "Forced-Identification" users.
Whenever a Forced-Identification user logs on to any ObserveIT-monitored server or workstation, the user will first enter their credentials in the regular Windows logon screen prompt. After passing that authentication phase, the user will be displayed with a secondary ObserveIT logon screen.
In this version of ObserveIT, the secondary ObserveIT logon prompt has been re-written to appear faster that before, allowing the logged on user faster access to the desktop.
Figure 8: ObserveIT Secondary Logon
Indication of the length of user sessions
ObserveIT now allows an administrator or auditor to clearly view the overall length of a user session. It does so by displaying the start and end time of each session. This change makes it easier to quickly determine the start and end of each user session.
Note: If the user session is still active, that last user action time is reflected on the results window, however an “On-Air” icon will represent the fact that the session is still active and the user is still logged on to that server.
Figure 1: Session Duration
Conclusion
Based upon customer feedback and development map, the new version of ObserveIT brings exciting new capabilities and UI changes, allowing administrators and auditors to have a far better control, flexibility and granularity when configuring the various policies and management tasks. Real-time replying of recorded sessions is now made available, along with Server Messages and recording policy improvements and better granular access control configuration for user objects.
Article Tags