Atlas

Keystrike Atlas provides real-time visibility into remote access activity across the organization’s environment.

Lightweight agents monitor inbound and outbound remote access activity, including RDP, SSH, PsExec, WinRM, WMI, SMB, VNC, Telnet, and FTP connections, and report this activity to the Keystrike platform. The Admin Panel provides an interactive network graph with search, filtering, and natural-language querying.

Atlas provides visibility into connections, clients, users, servers, and jump hosts, helping identify unknown clients, unmanaged servers, and unexpected or unsanctioned remote access activity. It provides the visibility layer alongside Keystrike Core Protector, which can enforce controls against unauthorized RDP and SSH access and activity.

All remote access connections within the selected time period are displayed. By default, the time window is set to the last 4 hours.

Use the controls around the graph to adjust how connections are displayed. These controls change the visualization without changing the underlying connection data or active filters. Navigation controls on the left side of the graph let you explore the visualization:

Controls in the upper-right corner provide additional options for organizing and displaying the graph:

You can filter the graph using natural-language queries in the language of your choice. Your query is converted into a filter, which you can then save for future use.

Sample queries are displayed when the page loads and when you hover over the query field.

Examples include:

Filters let you narrow the connections displayed in the graph to the activity you want to investigate. You can create a filter in two ways:

A filter can contain multiple conditions. Add or remove conditions as needed to refine the results displayed in the graph. For example, you could filter for inbound RDP connections from unknown devices, or combine protocol, user, device, and connection properties to investigate more specific activity.

If you expect to use a filter again, select Save filter and give it a descriptive name. When saving a filter, you can choose its visibility:

Saved filters can be accessed from the Saved filters dropdown. Filters are grouped by visibility, making it easy to distinguish your personal filters from filters shared across the organization. Selecting a saved filter applies its conditions to the graph, allowing you to quickly return to frequently used views without rebuilding the filter.



Saved filters can be managed by selecting the gear icon in the Saved filters dropdown.

The Manage filters dialog organizes filters into the following sections:

For each saved filter, the dialog shows information such as the number of conditions it contains. Organization filters may also show when the filter was created and who created it.

Trust levels classify connections based on conditions defined by your organization. Each trust level is represented by a distinct color in the Atlas visualization, making it easier to identify connections that may require attention.

Quick filters for trust levels are available at the top of the graph. Use these to show connections for a specific trust level, such as High, Medium, Low, Untrusted, or Unknown, or select All to display connections regardless of trust level.

You can create a new trust-level filter by saving a filter and making it available to everyone in your organization. When saving the filter:



The saved filter is then used to classify connections that match its conditions. For example, you could create a filter for Telnet connections from unknown devices and assign those connections the Untrusted trust level.

A connection may match more than one trust-level filter. When this happens, the order of the filters determines which trust level is assigned. Trust-level filters are evaluated in the order shown in the Manage filters dialog. The first matching filter takes precedence. You can change the evaluation order by dragging trust-level filters into the desired position. The number beside each filter indicates its current precedence. For example, if a connection matches both an Untrusted filter and a Low trust filter, and the Untrusted filter appears first, the connection is classified as Untrusted.

Atlas includes default trust-level filters for common types of remote access activity. Default filters are identified by the Default filter label in the Manage filters dialog.

Default filters can be edited or deleted by an administrator. This allows organizations to adapt the default trust-level classification to their own security policies and environment.