Control Center¶
The Control Center module lets the administrator watch the privileged sessions of users — currently running or archived — and exploit the recordings (video, events, comments). It is used for after-the-fact review, live monitoring and to investigate alerts.
The module is organized in two main tabs:
| Tab | Description |
|---|---|
| Live streaming | Visualization of running privileged sessions. |
| Archives | Visualization of finished privileged sessions and their recordings. The tab is split into Graphical sessions and SSH sessions. |
Each video has an associated comments menu.
Live streaming¶
The Live streaming tab lists active privileged sessions as thumbnails. The left panel shows the recent events reported by the probes; a search field filters that list on the fly.
Filtering displayed sessions¶
This tab offers a single filter, which restricts the display to selected users.
| Item | Description |
|---|---|
| Display all data of all users | Ticked by default: every privileged session and every event is displayed. Unticking it enables the selection grid below. |
| Filter users | Grid with one row per user (Domain, Name), and two independent check-boxes: one to display their sessions, the other to display their events. |
| Number of users with sessions being shown | Counter of the users whose sessions are currently displayed. |
| Number of users with events being shown | Counter of the users whose events are currently displayed. |
No type or sharing filter in this tab
The service type filter and the shared sessions filter only exist in the Archives tab (see section List, filters and sorting).
Live session detail¶
Double-clicking a thumbnail opens the detail screen. Depending on the session type, it embeds the video player (graphical or SSH) and a real-time event list refreshed every 15 seconds.
The available actions depend on the session type:
| Action | Effect |
|---|---|
| Back | Returns to the live session list. |
| Comments | Opens the comments module on the session. |
| End session / Sign out | Terminates the running privileged session. The button reads Sign out for RDS without agent and VNC sessions, and End session in every other case. |
| Pause / Resume | Two distinct buttons shown alternately: Pause on a running session, Resume on a suspended one. Pause is not offered on web sessions (recorded web application or recorded reverse proxy). |
| Join the session | Lets the administrator join the session through session sharing. Visible only on HTML5 sessions, and only when session sharing is enabled — it is granted by the assistance profiles. |
Event counters and levels¶
Below the event list, a bar of toggle buttons filters by event level (info, warning, alert, etc.). Each button displays its counter; clicking activates or deactivates the matching filter.
Archives¶
The Archives tab is split into two sub-tabs: Graphical sessions and SSH sessions. Each exposes the same action bar.
List, filters and sorting¶
A Thumbnails / List button switches the display between thumbnails and grid. The grid offers the following (configurable) columns:
| Column | Description |
|---|---|
| Server | Target server of the session. |
| User | Account that opened the session. |
| Other users | Accounts that joined the session through session sharing. |
| Domain | Authentication domain of the account. |
| Service type | Icon of the service (RDP, SSH, VNC, etc.). |
| Date / Start / End | Timestamps. |
| Duration, Size | Duration and size of the video file. |
| Expiration date | Automatic purge deadline. |
| Activity | Activity index of the session, used for fast scrubbing in the video. ⚠ The column is only populated when Enable the measurement of user activity is ticked in the general options, and only for applications fitted with a recording agent. |
The collapsible filter panel above the grid contains:
| Filter block | Description |
|---|---|
| Service type | Multi-selection of service types (RDP, SSH, VNC, RDS without agent, direct recording, web, etc.). |
| Date range | Start date and end date, plus a Up to today check. |
| Activity | Activity index filter check to keep only sessions with an activity index. With activity measurement disabled, no session carries one. |
| Display | Three-value combo: All sessions (default), Only shared sessions, Only non-shared sessions. Visible only when session sharing is enabled. |
Actions on a selection¶
| Action | Description |
|---|---|
| Fullscreen | Opens the detailed playback screen. |
| Download | Generates the downloadable video file. For SSH, the .ttyrec file is generated server-side. |
| Delete | Deletes the selected session(s). The deletable flag must be true on every record; otherwise the button is disabled. |
| Comments | Opens the Comments module for the session. |
Detailed playback of an archived video¶
The detail screen contains:
- the video player (HTML5 for graphical sessions, dedicated SSH player for SSH sessions);
- the time bar with play / pause, elapsed / duration counter and fullscreen;
- a Details grid (account, server, restrictions, expiration, etc.);
- the session event list.
Exporting events¶
In the detail screen (live or archive), an Export button in the events area produces a CSV file.
Exported file content
The CSV file has the same name as the video by default. Event rows are preceded by a header containing the session information and the export date.
Adding a custom event¶
The administrator can add a manual event on a video (for example to flag an observed fact). The form requires an entry in the Detail field.
Searching the archives¶
The search field above the grid retrieves a session by user, server, event or comment content. Results are enriched with the matching context (events, related comments) directly inside the result cell.
The search accepts filters in square brackets, which restrict it to one scope. Only one filter applies at a time: choosing another one replaces the previous, filters do not stack. The filters offered depend on the current sub-tab:
| Filter | Scope | Availability |
|---|---|---|
[Domain] |
Authentication domain of the account | always |
[Username] |
Account that opened the session | always |
[Other users] |
Accounts that joined the session | session sharing enabled |
[Gateway] |
Edge Gateway used | always |
[HTML5 Gateway] |
HTML5 Gateway used | always |
[Target server] |
Server reached by the session | always |
[Application] |
Application opened | always |
[Comments] |
Comment content | always |
[Author of the comment] |
Author of a comment | always |
[Recorded machine name] |
Workstation the session was opened from | always |
[Connection of another user] |
Events of a participant joining | session sharing enabled |
[SSH Keystroke] |
Commands typed in an SSH session | SSH sessions |
[SSH Event] |
Other events of an SSH session | SSH sessions |
[Keystroke] |
Keystroke events | graphical sessions |
[Clipboard] |
Clipboard events | graphical sessions |
[Window Opening] |
Window openings | graphical sessions |
[Window Closing] |
Window closings | graphical sessions |
[Program Launch] |
Program launches | graphical sessions |
[Program Closing] |
Program closings | graphical sessions |
[File] |
File transfer events | graphical sessions |
[Alert] |
Alerts raised during the session | graphical sessions |
[Customized event] |
Events added manually (see 2.5) | graphical sessions |
The filter name follows the console language
These labels are translated: the [Keystroke] filter reads [Frappe clavier] when the console is in French. Use the label of the language configured in the product, not that of another language.