February 7, 2013 at 14:04Effective video monitoring of user actions with NetWrix User Activity Video Reporter 1.0
In this post, we will talk about our new program, NetWrix User Activity Video Reporter , designed for video monitoring of user actions on servers and critical workstations, and also consider how you can efficiently use its free version in order to track specific user activity.
Under the cutter - an overview of the functions, configuration of the program, a short video review and advice on using the free version of the program.
As the name implies, the program performs video recording of user actions. The program uses NetWrix VideoScape technology, which assigns action meta tags and allows you to quickly go to the records of certain actions made by the user. For example, to understand how a certain event happened, you can simply enter certain information and save yourself from hours of watching a video - you can see everything right away if you set certain filters.
At the same time, you can understand why the user did this - by accident or deliberately. Video recording even at the lowest level of quality allows you to understand all the actions performed.
A separate point is tracking vendor actions. For example, you transfer part of the work to administer the IT infrastructure of another company; accordingly, it is important to record the actions performed by its specialists.
Using the program, you can add another level of visibility to the administration and actually monitor the actions of privileged accounts in the most visual mode - in video mode. In fact, the information is presented as clearly as possible - here we see that the administrator somewhere in Samara, after starting a remote session from home at night, changed access rights for users of a particular OU. Recording of a specific action by the meta tag system in NetWrix VideoScape technology will help you find it.- configure filters (for example, launching a specific application or window title) and get only relevant information.
By the way, it is absolutely not necessary to configure the program so that it tracks all user actions. If you are only interested in working with certain applications, then this is easy to configure at the stage of configuring the observed object.
Briefly about the product (we answer the question: “should you read this review further?”):
Let's start with a formal presentation. NetWrix User Activity Video Reporter is a tool for monitoring user actions (data collection and reporting). Product Feature List:
- Video recording of user actions during both interactive and remote sessions;
- Session metadata collection (application names, window titles, etc.) that can be used for filtering and searching data inside videos;
- Ability to customize recording sizes (recording actions of specific users and applications; recording quality settings);
- Reports (in the form of tables and diagrams) on user actions with extensive sorting and filtering capabilities;
- The function of subscribing to receive reports - automatic receipt of reports by email;
- Integration with the NetWrix Change Reporter Suite audit system allows you to see how a particular change was implemented (link “product that captures the change - video recording”);
- The “NetWrix Console Audit” console allows you to track any activity performed using the NetWrix Management Console and track changes made to the configuration of NetWrix software modules, monitored objects, and global settings.
Product work
Data collection and generation of reports based on them is as follows:
- The administrator configures the observed objects and sets the parameters for automatic video recording;
- NetWrix User Activity Video Reporter monitors computers and records user activities. Videos are stored in a local directory called “Audit Archive”;
- The program sends Activity Summaries reports to mail to those recipients that were selected during the product configuration phase (p. 1);
- When the “Reports” function is enabled and configured, the data is imported from Audit Archive into the SQL database. Reports can be viewed through the NetWrix Enterprise Management Console or browser.
The product, as already mentioned above, is integrated into the console. We will not write about the console itself and its capabilities here, we are sending it to the Administrator Guide or the review on Habr .
Product setup
The setup process itself is quite simple, so we also outline it briefly. Product setup begins with the assignment of the observed object.
1. As the observed object, select “Computer Collection”
2. Set the account that will be used by default for data collection;
3. Set the SMTP server settings;
4. Set the name of the collection of computers;
5. We set SQL Server settings (for generating reports) (by the way, there is a function to automatically install and configure a new instance of SQL Server Express Edition)
6. After that, add items to the collection.
Windows Server acts as the item type.
There are several options for adding (computer name, AD container , IP address range, export from .csv file)
7. We specify the users whose actions will be monitored (everything, selectively, exclude)
8. Set the sending of reports
As you can see, you can receive reports quite often, which will allow you to quickly respond.
9. We complete the configuration.
Working with the program
Program settings are accessed from the NetWrix Management Console. Expand the Managed Objects node -
What can be configured:
- Users
- Applications
- Video Recording
- Sending reports (Activity Summary Delivery)
Users
By clicking on the “ Specify Users ... ” button, a dialog box opens in which you are asked to select the users whose actions you want to monitor.
Applications
In the event that we track individual applications, you will need to specify their names.
Video Settings
We set the quality of the video, the duration of the recording and storage of the recordings.
Report Submission
We set the recipient address and the frequency of sending reports.
Example of a report in the mail.
By clicking on the link (in the Start Time column) a video recording is opened.
Monitored computers
The Monitored Computers console node allows you to check and manage the status of agents installed on the computers that are being monitored.
Access ( Managed Objects -
Activity Records
The Activity Records page gives access to videos; filtering is set by you. Access to them - ( Managed Objects -
As we can see, there are plenty of filters:
- Period of time
- A computer
- User
- Applications
- Window title
Adjust the filters and click Generate Summary.
As an example, consider the Activity Records report:
From the console, you can immediately see how a specific action was performed. Video can be saved.
Reports
In version 1.0, five reports are still available.
Take the “ All Users Activity ” report as an example .
Adjust the filters and finally get such a report.
By clicking on the date, the video of the action opens.
NetWrix Console Audit
This option allows you to track changes made to monitored objects, NetWrix program configurations, and global console settings.
By clicking on the Configure button , an observable object is created, similar to that described at the program setup stage.
The program can be viewed in a short video
We use the free version productively.
The program is available as usual in two versions - the basic free and advanced commercial . And the main limitation that exists in the free version is that video recording of user actions stops after 30 minutes of working with the application. It would seem that such a restriction negates the fact of the existence of a free version. However, we pay attention to the fact that video recording can start when a certain application is launched, and even the window title. Take the example of working with SalesForce. We are interested in the user's appeal to this site and actions with it.
In the Applications section, add Application Description * (or you can specify the browser that your users use), but specify the title of the window (Window Title) as * salesforce *. You can go further and clarify the appeal to a specific element of the site, for example, to a specific report, for example, “Leads Daily ~ salesforce *”, to get only video recordings of working with it. Considering that the user does not sit around this report all the time, and periodically opens it during the day, 30 minutes will be enough to track activity during the day.
And this is just one example. Other options for using the program to track activity, you can, without a doubt, come up with yourself, based on the specifics of your users.