To configure sending events to Traffic Monitor, the following principles should be taken into consideration: - Interception events are passed to Traffic Monitor in the form of "event" object
- Each "event" has a set of required attributes specified by the user of the programming interface
- Each "event" may have a set of optional attributes specified by the user of the programming interface
- Each "event" has a "sender" and a "recipient"
- Each sender or recipient may have a list of associated "contacts" which are used to uniquely identify this sender/recipient
- Each "sender" or "recipient" may have a list of attributes associated with this sender/recipient
- Each "event" has associated "data", that is a set of bytes and/or text characters which represent the contents of the intercepted event
- Each element of the "data" should have a set of data associated with this element
All possible "events" that can be received by Traffic Monitor and analyzed are divided into groups (event "classes") united by common characteristics. The event class defines the business logic of the event processing and how the event will be displayed in Traffic Monitor console.
For now, the following event classes are supported: - – any events of sending emails including emails with attachments. The event is characterized by a list of senders and recipients (persons), a sending date, a subject, a message body, and attachments. Includes corporate email (IMAP, POP3, SMTP, MAPI, NRPC) and webmail (HTTP, HTTPS). Service name in TM: E-mail;
- – any events of exchanging only text messages or files within a single application. The application can be either a thin client on workstations and mobile devices or a web application. The event is characterized by a list of remarks. For each remark, the sender (person), the time of sending, and the message text must be specified.
- The following services are preinstalled in this class: Mobile communication, WhatsApp, Yahoo!, MS Linc, ICQ, Mail.ru, Jabber, Skype (SMS and text messages tranferring). Service name in TM: Messenger;
- Printers and MFPs – events of data conversion on "specialized" devices for input/output of images and documents (e.g., printers, scanners). The event is characterized by a sender (person), a recipient (device), a number of copies, and a file with the original document/document image/print task. The class has a preinstalled service – Printer. Service name in TM: Printer and MFD;
- – events of sending requests from web browsers and similar programs via HTTP/ HTTPS protocols. Data for which no other class is selected also refers to this class. Sending a web message can be an example of an internet activity. The event is characterized by a sender (person) and a recipient (resource) for POST requests or a recipient (person) and a sender (resource) for GET requests. It is also characterized by the body of a "raw" request
- . The class has a preinstalled service – Internet application. Service name in TM: Web activity;
- Photo – events of photographing using device camera. The event is characterized by a sender (person) and a recipient (device). It is also characterized by an intercepted image. The class has a preinstalled service – Photo camera. Service name in TM: Recording media;
- File exchange – any event of transferring files between any senders and recipients. The event is characterized by a sender (person), a recipient (person/device/resource), and the intercepted file. Includes copying data to removable USB devices, cloud storage,
- sharing files via FTTP protocol. The following services are preinstalled in this class: FTP, External device, Mobile communication, WhatsApp, Yahoo!, MS Linc, ICQ, Mail.ru, Jabber, Skype. Service name in TM: Messengers (if recipient and sender are persons) or File exchange (if at least one recipient or sender are not persons).
- Call – any event of voice or video call via messenger or phone. The event is characterized by a person-sender (call initiator) and persons-recipients. It is also characterized by a file and a record time. Example: sending/receiving SMS or MMS or intercepting calls in social media. The class has the following preinstalled services: Mobile communication, MS Lync, Mail.ru, Jabber. Service name in TM: Messenger;
- Recording media – event of recording audio or video using a device. The event is characterized by a person-sender, a device-recipient, and an intercepted image. Example: microphone or dictaphone recordings, videocamera recordings and any events of photographing potentially confidential documents using device camera. Service name in TM: Recording media.
The SDK user should define a "class" of object intercepted by SDK
Besides, the SDK should define the the intercepted object The serviceService" determines what exactly was intercepted from the point of view of the user service, which the "sender" used for transferring data. | Информация |
|---|
| As per the user service Skype, the interceptor of this service can generate events as a "Chat". |
The SDK user can select a service from the list of services embedded in Traffic Monitor or define and register a custom service. The licensing policy in Traffic Monitor is implemented based on the object " | title | protocol" and the interceptor vendor identifier. The object "service" is a sequence of characters defined by the SDK user.
| Информация |
|---|
"" The "service" of the intercepted object can take part in creating a "policy" in Traffic Monitor, as well as in various analytical queries.
For each "event", "sender(s)" and "recipient(s)" must be defined.
The following types of "senders" and "recipients" are supported:
- A "person" is a "user" who is defined as a creator, a sender or a recipient of the intercepted object. For the person identification, a set of person's contacts can be defined. The contact type can be selected from the list which is supported by SDK. An example of the contact type can be email, phone number or a Windows account;
- A "workstation" is a computer, a mobile device or a terminal server, where the intercepted object was "created". For this type of a "sender", a list of "contacts" can be defined;
- A "resource" is an address on the Internet to which data is passed;
- A "device" is a device that receives data when files are copied to removable devices.
The list of contacts associated with a "person" makes it possible to identify the person by the contact. So, any intercepted actions of a "person" where at least one contact of the person is defined, allows Traffic Monitor to identify a particular user.
The SDK interface allows you to create logical connections between different objects, for example, a
sender Workstation. This allows you to accurately determine the context of an intercepted operation, that is to determine who has initiated the data transferring and where.
For adding custom "services", a special file in a specific format will be used. This file will be loaded into the system through Traffic Monitor console and update internal data structures. Then, new services will be able to participate in creating rules and analytical queries.
The SDK interface enables sending data to a network in parts. It allows external developers to define, how to limit the load on the network.
A general algorithm of passing event the SDK interface looks like the following:
- Create an "event" object and set its attributes;
- Create senders/recipients of the event and specify their contacts and attributes;
- Create the event data and set its attributes;
- Establish connection with Traffic Monitor;
- Check access to Traffic Monitor and a plugin license of an external developer;
- Pass the event
- ;
- Pass contents of the event data in parts;
- Close the connection;
- Delete the event object.
For more details on the process of passing events, see SDK Samples.
|---|