macOS User Activity Monitoring


Ekran System® works to make your infrastructure as transparent as possible increasing visibility of user actions performed across various contexts, applications and platforms.


mac user activity monitoring

Besides Windows, Citrix, Linux, and UNIX, our insider threat protection product now delivers Mac desktop monitoring.

Supported platform versions: macOS 10.9 - 10.14








macOS Session Audit


A robust insider threat program should include tools to track and audit employee activity at their digital workplace. With macOS desktops conquering enterprise market, companies need an efficient macOS monitoring software to complement their existing security audit toolset.


Ekran System captures any user action together with its context in the rich recording format: user screen video recording with multi-layer metadata index.


You can replay any session in the Youtube-like Ekran System player, watching video and synchronized detail log. macOS monitoring metadata for includes:

  • Computer name
  • User name
  • Active application name
  • Active window title
  • URL currently opened in a user browser
  • Host / remote host IP address(es) details

This multi-layer details index each moment of the recorded sessions. It allows you to search in and across recorded sessions not only on macOS but also on other platforms at the same time and quickly jump to the key episodes for the context-aware situation investigation.



Be More Proactive with Alerts


Ekran System video + metadata Mac system monitoring format enables such useful incident response tool as alerts on events.


After you have described a potentially critical event using a combination of rules around metadata (or chosen a set of them from the in-built Ekran System recommended alert pack), you indicate what actions should be performed automatically when this event is triggered:

  • Send notification with a link to the corresponding session
  • Show warning message to the user, who triggered the alert
  • Block the user, who triggered the alert
  • Kill the process (application), where the alert was triggered.

Possibility to automatically and manually block potential malicious actions is a useful incident response tool complementing Mac activity monitor functionality.



Stay Informed with Reports


When performing Mac user activity monitoring with Ekran System, you get not only session records and investigation tools, but also a number of summary reports, which help you to build an overview of the current situation.


Reports include visited URLs, started applications, spent time and other summaries.


Besides reporting, Ekran System provides forensic session record export feature to support your legal actions with reliable evidences.