This section provides information on how to use the browser to play video files of recorded audit trails, or how to follow active sessions.

Figure 172: Replaying audit trails or following active sessions in your browser

Following active sessions

If you are following an active session, a green Following label is displayed in the top-right corner of the screen, and there is a green, pulsing dot on the menu bar. If you stop following the session, for example, by jumping back in the video, a green Follow button is displayed on the menu bar, which allows you to continue to follow the active session. If a session is not active anymore, the Following label and the green dot are not displayed.

Player window controls

TIP: You can quickly zoom in or out by clicking anywhere in the Player window.

NOTE: From the video, you can copy the content of text-based protocols to the clipboard:

  1. Select the required content.

  2. Right click on the selected content.

  3. From the list of available options, select Copy.

The Player window has the following controls:

  • , : Play, Pause.

  • ,: Jump to previous event, Jump to next event.

    If you use the button, the video playing is stopped so that you can jump back to preceding events.

  • : Adjust replay speed. The possible increments are: 0,25, 0,5, 1, 1,5, 2, 3, and 5.

  • Time-related information and options of audit trails:

    • : Time since the audit trail started / Length of the audit trail.

    • To jump to a timestamp in the video, click on the time.

      : Time since the audit trail started (top) / Jump to a timestamp (left) / Length of the audit trail (right).

    • : Time since the audit trail started when following an active session.

  • : List of keyboard events. Special characters like SHIFT, ENTER, F1, and so on, and mouse usage are displayed as buttons. If the upstream traffic is encrypted, upload your permanent or temporary keys to User menu > Audit keystore to display the keyboard events. This will not be displayed if your upstream traffic is encrypted but not unlocked.

  • : Share. You can copy the link of a session, or optionally, obtain the link of a session starting from a specific timestamp.

  • : Encoding settings. This option enables you to set the encoding for terminal-based and graphical protocols.

    For terminal-based protocols, you can set the following:

    • Terminal encoding layout

    • Telnet codec

    • Telnet alternate codec

    For graphical protocols, you can set the keyboard layout.

    You can save your video encoding settings, which are stored locally, in your browser.

  • : Create a screenshot.

  • : Show / hide events. Select the types of events to display. The available options are Keystroke, Mouse activity, and On-screen changes. Depending on the protocol used and how the audit trail was processed, SPS can display keyboard events, commands, mouse events, and window titles. Commands and window titles are displayed as subtitles at the bottom of the screen. This will not be displayed if your upstream traffic is encrypted but not unlocked.

  • , : Switching fullscreen mode on and off

  • : Progress bar and distribution of events. Light blue - screen change, blue - keyboard or mouse event, dark blue - command or title event. This will not be displayed if your upstream traffic is encrypted but not unlocked.

  • : Close the player, and return to the Connection details page.