The Session Player

The Session Player is the main pane in the Session Viewer, and is located in the top left area of it. The Session Player allows the viewing of screen captures / video of user activity recorded on computers with the Syteca Client installed, or the viewing of a graphical representation of Linux terminal data recorded (i.e. the input and output as the user sees them in the terminal).

Any of these screen captures / video frames or graphical representations can be viewed individually by clicking on the required activity record in the Metadata grid (which is on the right of the Session Player), or all of the monitored data together can be viewed by playing the session.

1. The Session Player Interface

The following functions are available in the Session Player:

• To play/pause the session, click the Play/Pause (

) button (or in Full Screen mode, press the Space bar to pause and resume playback).

• To switch between adjacent records, click the Previous and Next (

) buttons (or in Full Screen mode, press the Left Arrow and Right Arrow keys on the keyboard) to move between the previous and next records in the session respectively.

NOTE: It should also be noted that switching between records (as displayed in the Metadata grid, which is located on the right of the Session Player), actually means switching between the screen captures, and therefore, since each record may contain multiple screen captures, these buttons will not always switch between records (in the Metadata grid) every time they are clicked (i.e. in the event that there is more than one screen capture in the record concerned). In a similar way, some records may not contain any screen captures, and will therefore be skipped.

NOTE: When video is recorded (in Full-Motion Capture mode), the above buttons instead skip backwards and forwards in the video respectively, in increments of 10 seconds.

• To switch between any linked sessions (only if the session was restarted at midnight), click the Previous Session and Next Session (

) buttons (see also the Switching Between Linked Sessions section below).

• To open the Session Player in Full Screen mode, double-click anywhere on the Session Player, or click the

button (or press the F key on the keyboard).

• To enter or exit Full Screen mode, double-click anywhere on the Session Player or click the

button (or press the F and Esc keys respectively on the keyboard).

• To change the layout displayed in the Session Viewer: Click the

button (in the bottom right of the Session Player). The Session Player is then displayed at the full width, while the Metadata grid is moved beneath it (and is also displayed at the full width), with the Details area not displayed at all. The

button can then be clicked again to toggle back to the default layout. The size of the Session Player can also be changed by simply dragging the corresponding boundaries between it and the Metadata grid, and between it and the Details area.

NOTE: When video is recorded (in Full-Motion Capture mode), the above button instead opens the Session Player in Full Screen mode.

• To zoom into a specific place on the screen, click the Magnifying Glass (

) button (in the bottom right of the Session Player).

• To move from one monitor to another in Client sessions with multiple monitors, click the Tools (

) button (in the top-right of the Session Player), and then select Display Screens and either All, 1, 2, 3, 4, etc (to specify which monitor to display), in the drop-down list.

• To adjust the speed at which the session of the monitored data is playing in the Session Player, click the

button (in the bottom right of the Session Player), and the required playback speed can then be selected from the options available: 1X/2X/4X/8X/16X frame(s) per second.

NOTE: When video is recorded (in Full-Motion Capture mode), instead of the above button, the

button is available with the following playback speed options are available: 0.5x/0.75x/Normal/1.25x/1.5x/1.75x/2x/4x frame(s) per second.

• To block the user, click the

button at the top of the Session Player.

• To play a live session in real-time (with the Metadata grid and the Details area panes in the Session Viewer hidden), click the

button (at the top of the Session Player).

NOTE: The above option is not currently supported (when video is record) in Full-Motion Capture mode.

• To get a link to a specific place in the session, click the Tools (

) button (in the top-right of the Session Player), then select Current URL in the drop-down list.

• To download the screen capture that is currently displayed, click the Tools (

) button (in the top-right of the Session Player), and select Save Screen Capture in the drop-down list.

NOTE: The above option is not currently supported (when video is record) in Full-Motion Capture mode.

• To perform a Forensic Export, click the Tools (

) button (in the top-right of the Session Player), and select Forensic Export in the drop-down list, and then in the Session Forensic Export pop-up window that opens, define the settings, and click Export.

NOTE: The above option is currently only partially supported, where only the video (without the metadata) can be exported, and it is exported to MP4 format (instead of to EFE format used by the Syteca Forensic Player).

To select and view the required record of user activity in the session (i.e. the records displayed in the Metadata grid, which is located on the right of the Session Player), as well as by simply clicking on it, the keyboard can also be used to navigate between the records:

• To switch between adjacent records in the session, press the Up Arrow (previous record) and Down Arrow (next record) keys.

NOTE: Alternatively, the Previous and Next (

) buttons in the Session Player can also be used to switch between adjacent records. It should also be noted that switching between records, actually means switching between screen captures, and therefore, since each record may contain multiple screen captures frames, these buttons will not always switch between the records (in the Metadata grid) every time they are clicked (in the event that there is more than one screen capture in the record concerned). In a similar way, some records may not contain any screen captures, and will therefore be skipped.

NOTE: When video is recorded (in Full-Motion Capture mode), the above buttons instead skip backwards and forwards in the video respectively, in increments of 10 seconds.

• To switch between adjacent records in the session that contain alert events, press the Left Arrow (previous alert record) and Right Arrow (next alert record) keys.

2. Switching Between Linked Sessions

Sessions that have restarted automatically at midnight (for Windows, macOS, and Linux remote SSH sessions only) are linked to each other in the Session Player. These adjacent sessions can therefore easily be switched between by clicking the Previous Session and Next Session (

) buttons.

Table of Contents

1. The Session Player Interface

2. Switching Between Linked Sessions