Auditing Session Replays

For auditing purposes, ITM On-Prem (ObserveIT) enables you to view information about all sessions in the Web Console which were replayed by the user. A "session audit" entry is added whenever a user opens the video Session Player for a session.

To view details about sessions that were replayed

1. Navigate to the Configuration > Security & Privacy > Audit > Sessions tab.

   

   For each session audit entry, the Audit Sessions list displays the following details:

   • Audit Hour: The time that the audit entry was created (that is, when the user opened the Video player for the session).

   • Operator: The Console User that accessed the Web Console.

      "(this screen)" is added next to the Console User name for video sessions played from the Audit screen.

   • Client: The IP address which was used to log on to the Web Console.

   • Endpoint: The name of the server on which the session took place.

   • Session Login: The user that logged in to the session.

   • Session Date: The date and time that the session occurred.

   • Video icon: Click to replay the session. When Session Replay Privacy Protection is enabled, a lock icon appears next to the Video icon. When clicking the Video icon, users will be prompted to enter their Replay Privacy Protection password. For further details, see Securing the Privacy of Session Replay.

2. You can click to expand a session to view more details.

3. You can filter the display of the Audit Sessions list according to the following search criteria:

   • Operator: (Console User name)

   • IP: Remote IP address of the management workstation

   • Up To: Date

   • Played from: Screen from which the session was viewed

     • any screen (the default): Shows video sessions played from the Audit Session screen and any other screen

     • this screen: Shows only video sessions played from the Audit Sessions screen

     • other screens: Shows only video sessions played from any screen other tan the Audit Sessions screen