Proofpoint | ObserveIT On-Premises Insider Threat Management
Replaying User Sessions
ObserveIT allows you to replay recorded user sessions by using a VCR-like Session Player. ObserveIT provides two versions; a Windows Session Player for replaying Windows recorded sessions, and a Unix Session Player for replaying Unix recorded sessions. The Session Player opens in a separate browser window.
If a session contains many slides, there could be problems viewing them in the Session Player. To prevent the loss of data, a session can be configured to close automatically when the number of slides reaches a predefined maximum number, and a new session started. For more details, see Configuring the Forced Timeout of Large Sessions.
Similar to a real-life VCR player, ObserveIT's Session Player can be used to play the recorded session starting from the first slide, and throughout the entire recording until it reaches the last slide. You can stop/resume the play at any point by clicking the Pause/Resume button.
Using the Session Player, you can also play the recorded session starting from a specific point in time. This feature saves the auditor or administrator from having to review the whole session, as the recording can be played from the exact time that the specific action performed by the user is of particular interest.
The following procedures describe how to replay a recorded session from "start to finish" or from a "specific point in time".
To replay the entire recorded session from start to finish
In the Activities View of the Endpoint Diary or User Diary, click the Video or icon to the right of the required session.
- The Session Player is launched in a new browser window, and you can begin viewing the recorded session.
If the selected session is a Windows session, the Session Player will open; if the selected session is a Unix session, the Unix Session Player will open.
To begin playing the recorded session starting from a specific point in time
In the Activities View of the Endpoint Diary or User Diary, expand the user session you are interested in by clicking the icon to the left of the session.
Review the textual transcript of the applications, files, or window titles that the user accessed, or the user input that the user entered during the session, and find the specific action that has particular interest.
The Windows or Unix Session Player is launched in a new browser window, and you can begin viewing the recorded session from the point in time when the user action was performed.
You can also begin playing a recorded session from a specific point in time from the Session Player itself.