<h3><strong>Investigation - Digital Forensics</strong></h3>
<p>Determine intent of high risk activity</p>
<p>ObserveIT initiates forensic recording for high-risk activity, which makes it easy to watch exactly what users are doing and reduce investigations to minutes instead of months.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/7_-_Forensic_Recordings_0.png" alt="" /></p>
<h3>Digital Forensics: Key Capabilities</h3>
<p><strong>Video Recording of All User Activity</strong></p>
<p>Records all user interface actions that occur when someone is accessing applications.</p>
<p><strong>Generates Textual Audit Logs for Every App</strong></p>
<p>All on-screen activity is transcribed into an easy-to-read list of exactly what the user did.</p>
<p><strong>Advanced Keylogging of All On-Screen Activity</strong></p>
<p>Record every key press including keyboard shortcuts, auto-complete and Windows clipboard.</p>
<p><strong>Collects Irrefutable Forensic Evidence</strong></p>
<p>Precise forensic evidence that shows visually exactly what the user did.</p>
<p><strong>Document and Share Suspicious Sessions</strong></p>
<p>Export entire recordings or selected slides to HTML file or the textual transcript to Excel.</p>
<p><strong>One-click SIEM Integrations</strong></p>
<p>Simple tie-in of insider threat intelligence for any SIEM (HP ArcSight, IBM QRadar, Splunk, etc.).</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/bbbbbbb.png" alt="" /></p>
<p><strong>Investigation - Digital Forensics</strong></p>
<p>With ObserveIT's digital forensics, you can view live sessions, as they unfold, monitoring the user&rsquo;s actions as it is performed in real-time, and being able to understand the user&rsquo;s intent, interact with users who are performing out-of-scope activity, and immediately lock sessions.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensic-recording-11.png" alt="" /></p>
<p>While this information is crucial for real time investigations of what is going on at any given moment, because many security breaches are actually rolling events that evolve with time (vs. one-time incidents), having these recordings stored in an easy to use searchable format it also provides a valuable tool for forensic investigations, allowing security teams to perform data breach investigations spanning days, weeks and even months.</p>
<p>&nbsp;</p>
<p>ObserveIT&rsquo;s unique capability to identify usage of shared accounts, adding the ability to know exactly who has used these accounts, reduces confusion and eliminates a lot of the finger pointing that may be part of a regular forensic investigation. This way, if a user used the &ldquo;administrator&rdquo; or &ldquo;root&rdquo; account for example, you know exactly who that user was.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensic-recording-31.png" alt="" /></p>
<p>Using ObserveIT&rsquo;s extensive search capabilities, security teams can perform detailed analysis of recorded user activities and link them together. For example, a user trying to obtain administrative permissions, later running some probing commands against a server to see what share are accessible, then using a remote control tool to obtain access to a remote server, and using Putty to connect to the remote server.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensic-recording-4.png" alt="" /></p>
<p>ObserveIT's key logger captures every key press and command that was typed by the user in the recorded sessions. When needed for forensic investigations, any portion of the recording is directly accessible via keyword search in the ObserveIT Web Console. You can jump directly to relevant portions of recordings by searching for particular activities based on text entries, launched programs, and opened windows, system commands executed, and so on.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensic-recording-5.png" alt="" /></p>
<p>ObserveIT can be configured to digitally sign and encrypt all data (data in transit, data at rest), so it provides irrefutable forensic evidences that could be used for further inquiry and, if needed, legal actions.</p>
<p><img src="http://cobaweb.co/project/arimtechV2/contents/tinyMCE/forensic-recording-6.png" alt="" /></p>