Start Video Recording

After defining a detection policy for alert rules, you can specify actions to be taken when the alert is triggered.

You can select an action to start recording screenshots of every user activity from the time an alert is triggered in Start Video Recording.

This action can also be selected together with Warning Notifications and/or Blocking Messages actions that ITM On-Prem (ObserveIT) provides to notify users in real-time about any out-of-policy behavior.

The action to Start Video Recording is available on Windows and Mac Agents. For details on how to record suspicious user activity in standard recording mode on Unix Agents, see Start Standard Recording.

When selecting this action, note the following:

Record until the end of the session (default for users and applications that are set to 'record metadata-only').

This action can be applied only when your current recording policy is in metadata-only mode (i.e., only application metadata is recorded and no video is captured).

Recording continues until the end of the session.

In Activity Replay mode (Windows only), video will be captured according to the settings defined in Recording Policy.

This action is applied according to the triggers configured for recording time, user actions, and storage. (This option is available for Windows only.)

In order to stop video recording until the end of the session, ITM On-Prem (ObserveIT) provides an option that enables you to switch back to metadata-only recording mode after a specific number of seconds. You can configure this option in the Alert & Prevent Rules > Settings page (see Defining Settings for Rules).

Recording of video is performed only on monitored applications that are defined in the application recording policy.

For details, see Application Recording Policy.

In case of multiple Warning Notifications or Blocking Messages configuration, the video recording will be triggered also by alerts whose messages have not been displayed.