The Metadata Grid
The Metadata grid is the located on the right-hand side of the Session Viewer, and displays detailed information on monitored user activity in each session record.
The list of all activities recorded is displayed in the grid in the following columns:
• For Windows Clients:
- Activity Time: The time when the activity was recorded.
- Activity Title: The name of the active window that is associated with the recorded activity.
- Application Name: The name of the application opened on the Client computer.
- URL: The top and second-level domain name of the website visited.
- Text Data: The clipboard operation and data, file operation and path, or keystrokes logged.
- Alert/USB Rule: The name of the alert or USB rule triggered, where the colored bar displayed on the left of the record containing the alert / USB rule corresponds to the risk level of the alert or of the USB rule, as follows:
- Alerts with the Critical risk level are indicated by a red bar.
- Alerts with the High risk level are indicated by an orange bar.
- Alerts with the Normal risk level are indicated by a blue bar.
• For macOS Clients:
- Activity Time: The time when the activity was recorded.
- Activity Title: The name of the active window that is associated with the recorded activity.
- Application Name: The name of the application opened on the Client computer.
- URL: The top and second-level domain name of the website visited.
- Text Data: The clipboard operation and data, or file operation and path.
- Alert/USB Rule: The name of the alert triggered, where the colored bar displayed on the left of the record containing the alert corresponds to the risk level of the alert, as follows:
- Alerts with the Critical risk level are indicated by a red bar.
- Alerts with the High risk level are indicated by an orange bar.
- Alerts with the Normal risk level are indicated by a blue bar.
• For Linux Clients:
- Activity Time: The time when the command was executed.
- Activity Title: The name of the active window that is associated with the recorded activity.
- Command: The command executed.
- Function: The system call made.
- Parameters: The parameters of the command executed.
- Alert: The name of the alert triggered, where the colored bar displayed on the left of the record containing the alert corresponds to the risk level of the alert, as follows.
- Alerts with the Critical risk level are indicated by a red bar.
- Alerts with the High risk level are indicated by an orange bar.
- Alerts with the Normal risk level are indicated by a blue bar.
NOTE: By default, the data is sorted by Activity Time, and the order and size of the columns can be modified.
To select and view the required record of user activity in the session (i.e. the records displayed in the Metadata grid, which is located on the right of the Session Player in the Session Viewer), simply click on the required record, where the keyboard can also be used to navigate between the records:
• To navigate between all records in the session, press the Up Arrow (previous record) and Down Arrow (next record) keys.
• To navigate between the records in the session that containing alert events, press the Left Arrow (previous alert record) and Right Arrow (next alert record) keys.