Abstract: Embodiments of the invention provide novel systems, methods and software for replaying one or more events occurring on a monitored computer (or elsewhere). Such solutions can provide the ability for an operator to easily determine the exact user behavior that produced the event and can, in some cases, and provide evidence of what the user did, and the order in which the user performed the various activities. Various embodiments of the invention organize various pieces of information captured from the user's client workstation behavior, reassemble of the pieces into a complete session of the users' activities and/or replay the exact user behavior for the observer, in some cases using a web browser and JavaScript to replay the activities just as they were performed by the original user.

Abstract: Embodiments of the invention provide novel systems, methods and software for searching and/or analyzing text, based on a list of one or more keywords of interest. In a set of embodiments, a first computer generates a regular expression satisfied by a particular keyword of interest as well as a hash value corresponding to the keyword. In some embodiments, the regular expression and the hash value are transmitted to a second computer, which identifies a set of text associated with a particular event and/or evaluates the set of text against the regular expression. If the text satisfies the regular expression, the second computer might generate a text hash from the text. This text hash can be compared with the hash from the package, and if there is a match, the event might be identified as requiring monitoring, collection and/or further analysis.

Abstract: Embodiments of the invention provide systems, software and methods for monitoring events on a computer. In a set of embodiments, a monitoring application monitors events on a monitored computer. Each of the monitored events may be analyzed, and based on the analysis, some or all of the monitored events may be collected. A variety of rules may be used in analyzing events. In some cases, collected events can be queued, for example, by storing a representation of each collected event in an event cache. When connectivity with a monitoring computer is available, a connection with the monitoring computer may be established, and/or the queued events may be transmitted to the monitoring computer. In a particular set of embodiments, the monitoring application is designed to avoid detection by a user of the monitored computer.