Proofpoint | ObserveIT On-Premises Insider Threat Management
Viewing Recorded User Sessions
After successfully installing the server-side components of ObserveIT, and at least one ITM On-Prem (ObserveIT) Agent, a default recording policy is implemented, by which recording automatically begins. As soon as a user logs on to one of the monitored endpoints, all actions will be recorded. For each additional machine that you want to record, you must install an ITM On-Prem Agent (ObserveIT Agent) and obtain the proper licenses.
ObserveIT Administrators can customize the way these actions are recorded. For details about tasks related to configuration, customizations, and policy settings, see the Configuration Guide.
When running, the ITM On-Prem Agent (ObserveIT Agent) tray icon will appear in the tray notification area of the monitored endpoints. This icon can be hidden.
After sessions are recorded, you can review the recorded data, replay sessions, generate reports, and more. You can find these recorded sessions by using either the Endpoint or User Diaries, the Search option, or by running Reports.
After you find the session you are interested in, you can click the icon next to the user session to launch the ObserveIT Session Player, from which you can replay the entire recorded session. The VCR-like buttons in the Session Player enable you to pause, resume, rewind, or fast forward, the playing of the slides. From the Windows Session Player, you can also save sessions for offline viewing. For further details, see Replaying User Sessions.