SEB server monitoring question

[chriixd]

What can SEB server monitor? can i see if someone has softwares open in the background (even if not in the prohibited processes list) or if someone opens a software mid exam? Can i see the active processes myself?
Other than this, can the server version be edited and recompiled to add the possibility to monitor other things which are not monitored in the default version?
I'm worried someone could use softwares like anydesk or teamviewer that i don't know since there are thousands of them and it's impossible to add all of them into the prohibited list in the configuration of the client. thanks in advance.

[anhefti]

Hi

Yes this should be possible within the SEB logs that are sent to the SEB Server. The main part of the SEB Server monitoring is based on the SEB Logs and also depends on the configured Log Level within the SEB Exam Configuration.

For your case you need to set the Log Level to DEBUG to receive also debug logging from connected SEB clients.
In a SEB for Windows log this would be something like this:

2021-01-07 17:08:57.660 [01] - DEBUG: [ApplicationMonitor] Initialized 244 currently running processes.
2021-01-07 17:08:57.662 [01] - DEBUG: [ApplicationMonitor] Initialized blacklist with 36 applications: ptoneclk.exe, webexmta.exe, join.me.sentinel.exe, join.me.exe, g2mstart.exe, g2mlauncher.exe, Telegram.exe, Zoom.exe, Element.exe, CamtasiaUtl.exe, CamPlay.exe, Camtasia_Studio.exe, CamtasiaStudio.exe, Camtasia.exe, SkypeApp.exe, Riot, seamonkey, Discord, Slack, Teams, join.me, RPCSuite, RPCService, RemotePCDesktop, beamyourscreen-host, AeroAdmin, Mikogo-host, chromoting, vncserverui, vncviewer, vncserver, TeamViewer, GotoMeetingWinStore, g2mcomm.exe, SkypeHost, Skype
2021-01-07 17:08:57.667 [01] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (15092) belongs to application 'Element.exe' and needs to be terminated.
2021-01-07 17:08:57.668 [01] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (15372) belongs to application 'Element.exe' and needs to be terminated.
2021-01-07 17:08:57.669 [01] - DEBUG: [ApplicationMonitor] Process 'Zoom.exe' (2104) belongs to application 'Zoom.exe' and needs to be terminated.
2021-01-07 17:08:57.670 [01] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (2360) belongs to application 'Element.exe' and needs to be terminated.
2021-01-07 17:08:57.670 [01] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (18668) belongs to application 'Element.exe' and needs to be terminated.
2021-01-07 17:08:57.671 [01] - DEBUG: [ApplicationMonitor] Process 'Zoom.exe' (5728) belongs to application 'Zoom.exe' and needs to be terminated.
2021-01-07 17:08:57.671 [01] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (16436) belongs to application 'Element.exe' and needs to be terminated.
2021-01-07 17:08:57.674 [01] - DEBUG: [ApplicationMonitor] Initialized whitelist with 0 applications.
...
2021-01-07 17:09:02.559 [16] - DEBUG: [ApplicationMonitor] Window has changed from 'Taskbar' (1248120) to 'ActionCenter' (985114).
2021-01-07 17:09:03.019 [22] - DEBUG: [Browser Instance #1] Navigated.
2021-01-07 17:09:03.024 [23] - DEBUG: [ApplicationMonitor] Process 'node.exe' (7964) has been started.
2021-01-07 17:09:03.026 [23] - DEBUG: [ApplicationMonitor] Process 'svchost.exe' (11380) has been started.
2021-01-07 17:09:03.026 [23] - DEBUG: [ApplicationMonitor] Process 'CefSharp.BrowserSubprocess.exe' (19800) has been started.
2021-01-07 17:09:03.027 [23] - DEBUG: [ApplicationMonitor] Process 'CefSharp.BrowserSubprocess.exe' (19980) has been started.
2021-01-07 17:09:03.028 [23] - DEBUG: [ApplicationMonitor] Process 'CefSharp.BrowserSubprocess.exe' (9168) has been started.
2021-01-07 17:09:03.028 [23] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (15092) has been terminated.
2021-01-07 17:09:03.030 [23] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (15372) has been terminated.
2021-01-07 17:09:03.030 [23] - DEBUG: [ApplicationMonitor] Process 'Zoom.exe' (2104) has been terminated.
2021-01-07 17:09:03.032 [23] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (2360) has been terminated.
2021-01-07 17:09:03.033 [23] - DEBUG: [ApplicationMonitor] Process 'Update.exe' (18616) has been terminated.
2021-01-07 17:09:03.033 [23] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (18668) has been terminated.
2021-01-07 17:09:03.033 [23] - DEBUG: [ApplicationMonitor] Process 'Zoom.exe' (5728) has been terminated.
2021-01-07 17:09:03.034 [23] - DEBUG: [ApplicationMonitor] Process 'Element.exe' (16436) has been terminated.

These logs will also be shown on the SEB Server within the SEB client connection detail view where you can see the logs of a specific client. You also should be able to filter the list with logs messages of your interest e.g.: "[ApplicationMonitor]" would fit your needs here.

[chriixd]

tho the SEB server can't detect (and eventually warn me) if someone is using one of those softwares so i can proceed to search through the logs? Like, let's say the .exe file gets its name changed and the process name changes consequently, i would just see the changed process' name in the logs.

[anhefti]

Currently searching the logs is the way to do but we are working on improving the indicators to work better for such use-cases.
The concept of indicators, that warn you within the overall monitoring view, is already implemented and allows you to create indicators on specific log level and be triggered by specific log-tags. We already have some special indicators for battery, WiFi, error log and connection ping tracking, but not for the use-case you've described yet. For this we need to tag respective SEB client logs for all SEB clients (Windows, MacOS and iOS) and implement a respective debug log level indicator.

If I understand your use-case correctly, you want to have an indicator that shows you how many process are currently running on the client. Say we have a number of twenty processes, the indicator will show the number 20 and is colored in the color respective to the setup of the indicator. Now when a process is constantly started, stopped, renamed and started again, this indicator will show flip constantly from 20 to 21 and back to 20. So you can go to the detail view and search the logs, eventually lock the SEB client by taking action.

Another approach would be to have a indicator that counts starting processes during the session and is triggered by each start of the process. This will also indicate your use-case by seeing the indicator-number constantly going up and change its color.

The picture below just shows a theoretical future indicator setup for such a use-case:

The above indicator would be triggered by SEB client logs on Warn level that are tagged with <process-start> like:

2021-01-07 17:09:03.026 [23] - WARN: <process-start> [ApplicationMonitor] Process 'CefSharp.BrowserSubprocess.exe' (19800) has been started.

Since this can be considered as a useful use-case, I'm sure a respective future-request will have good changes to be taken for future work and improvements.

[chriixd]

thank you again, this is very useful indeed but the problem is a little different. i'm gonna use and example for you to understand better.
Let's say someone has opened a screen sharing / remote desktop software i don't know of and therefore it's not in the prohibited processes list. This software has been opened before opening the SEB client. The running processes number is now static since this software has been opened before SEB and not in mid exam. At this point i should be able to search the logs for that software in the processes list as we said earlier, but again, let's say i don't know the software in use and so im not able to recognize it in the processes, the question is, does SEB have some kind of function that detects screen sharing or remote desktop softwares (even if the software in use is NOT in the prohibited processes list) and eventually warns me about that so i can search for sketchy processes on that person logs only? The only other solution that comes up to my mind if that's not the case is searching through all the students' logs for a process i don't know and search every unknown process of every student on the internet to see if it's good or bad. Your solution is still really useful in case someone opens a piece of software DURING the exam (and that's also what i asked in the first discussion' post so thank you for responding to that) Thank you again for your work and for the blazing fast responses!

[anhefti]

Hi, I just had a chat with one of our SEB developers about your question;

Unfortunately no, this is not possible since SEB does not have an additional list or repository of potentially suspicious process to detect except the prohibited process list of the SEB Settings (configuration). The most-known remote software processes are per default in the prohibited process list and more can be added for individual needs. Since on a running OS there can potentially be hundreds of processes running while SEB is starting it is also not practical to log all this information.

Maybe you can do some whitelisting (see: the SEB documentation) to mitigate your problem.

[chriixd]

oh okay, thank you anyways for the responses