Viewing Alerts in the Session's Video

While replaying a recorded session using the Session Player, you can watch the session video for alert(s). If any alerts occurred on the session an alert indication will be displayed. Note that the color of the ring around the alert icon shows the alert risk level severity; critical (dark red), high (red), medium (orange), or low (gray).

For instructions on how to use the ObserveIT Session Player, see Using the Session Player or Unix Session Player.

To open a session's video for viewing alerts

1. In the AlertsList view, Details view, or Gallery view, click the Video icon next to the alert.

   The Session Player opens. Details for each alert are displayed as the replay progresses.

   Following is an example of a video replay of an ObserveIT session on which an alert was generated.

   

2. In the Alert Details Panel, you can view a summary of the alert activity including:

   • alert ID
   • severity
   • conditions (who, on which computer, when and did what)
   • MIP labels
   • number of alerts in the session (in the upper right corner, for example, 1/2 in the above example)

3. Click the Bell icon in the lower right part of the screen to toggle between showing or hiding the alert details, as required.

4. On the replay timeline bar, you can view alert indication icons, and hover over an alert icon to view the alert rule name.

5. In the User Activities List (on the right), you can view alert indications on the suspicious activities.