Keystrike Admin Panel
32 min
Current release
- Alert pages redesigned
- Alert pages have been redesigned so you can see trends at a glance, filter to what matters and better understand each alert session.
- Terminator Alerts page with a date range, filters, an time series chart and a richer alert session table.
- Alert session details include an explanation banner, a plain-language summary of the alert type where applicable.
- Terminator session timeline: shows the terminator session, the Keystrike session, the client connection and exactly when the alerts occurred, so you can see whether alerts happened inside a secure session or while the client was disconnected.
- Recovery code use and cancelled user mappings are better highlighted in the alert lists.
- Open in Activity Logs: jumps straight to the matching activity log entries for deeper investigation.
- Alerts are still recorded in the activity logs and sent to your configured webhooks as before; this change affects how they are presented in the admin panel.
- Filter style
- Filters now use a compact filter bar throughout the admin panel, including Alerts and Activity Logs. Large advanced filter panels have been replaced by a date range picker, the most common filters as chips, and Add filter for anything else. Only the filters you use take up space, which leaves more room for the results.
- Terminator bypass usage
- The Terminator bypass list now shows how many times each bypass policy has been used and when it was last used. This makes it easier to spot unused exceptions that can be removed. Usage is tracked from this release onward, so earlier use is not included.
- Open in activity logs
- Terminator, user, client, device, terminator bypass and alert pages now have an Open in Activity Logs button. It opens the activity logs already filtered to that item, so you can see its full history in one click.
- Open in Atlas
- Device pages now have an Open in Atlas button. It opens Atlas filtered to all remote access to and from that device, so you can see its connections at a glance.
- Atlas: internal and external IP addresses
- Atlas now tells internal (private) IP addresses apart from external (public) ones and shows which kind each connection uses. You can filter on this with the filter builder or by asking a question in plain language, such as “connections from external IPs”. This makes it easier to spot remote access coming from outside your network, or internal hosts connecting out to the internet, and to combine it with other conditions like protocol or trust level.
Previous releases
Note: The information in the past release notes may have been superseded by subsequent release notes. Please review all current release notes carefully.
- A reorganized admin panel menu
- The admin panel menu has been reorganized around the tasks you do most. Pages are now grouped into five sections:
- Visibility: Atlas, Alerts, Sessions, Activity Logs
- Protection: Terminator Groups, Unknown Users, Terminator Bypass, Recovery Codes
- Inventory: Users, Clients, Terminators, Devices
- Deployment: Installers, Invitations, Setup Approval, Auto Update
- Settings: Administrators, Login Methods, Notifications, Atlas Settings
- All your existing pages, data and settings are unchanged. Only their place in the menu has moved.
- Dark mode
- You can now switch the admin panel from the default light theme to dark mode, or choose to automatically match your system settings.
- Atlas - remote hostnames
- For unknown remote devices, hostnames are now automatically detected, where available, and displayed alongside their IP addresses.
- Keystrike Atlas – General Availability
- Keystrike Atlas is now generally available, providing real-time visibility into remote access activity across an organization’s environment.
- Lightweight agents monitor inbound and outbound remote access activity, including RDP, SSH, PsExec, WinRM, WMI, SMB, VNC, Telnet, and FTP connections, and report this activity to the Keystrike platform. The Admin Panel provides an interactive network graph with search, filtering, and natural-language querying.
- Atlas provides visibility into connections, clients, users, servers, and jump hosts, helping identify unknown clients, unmanaged servers, and unexpected or unsanctioned remote access activity.
- Atlas provides the visibility layer alongside Keystrike Core Protector, which can enforce controls against unauthorized RDP and SSH access and activity.
- Atlas reporting from client and terminator devices can be enabled or disabled in the Admin Panel under Configuration → Atlas
- Auto updates
- Clients and terminators can now be automatically updated when new releases become available.
- Auto-update policies can be configured in the Admin Panel under Setup & Installers → Auto update → Policy. Auto updates can be configured separately for clients and terminators. You can also define a maintenance window, specify the time or day of the week when updates should occur, and set a delay between release and deployment.
- By default, automatic updates are enabled for clients and disabled for terminators. It is recommended that automatic updates are enabled for terminators and configured according to your organization’s operational requirements and preferred maintenance schedule.
- The auto-update history can be viewed to review previous updates.
- If automatic updates are not enabled by policy, clients or terminators can be selected from their respective lists and update requested on demand.
- Bulk suspend and delete
- Users, Clients, and Terminators can now be suspended or deleted in bulk. Select multiple items from the relevant list, then choose the desired action in the upper-left corner of the page.
- Remote IP address in alert details
- The alert details page now displays the remote IP address of the connection that triggered the alert, as seen by the server.
- Dynamic remap
- Dynamic remapping now uses predefined user mappings instead of a separate option in Terminator groups. This provides greater flexibility by allowing you to remap individual users or groups of users rather than applying a single global remapping configuration to the server.
- Security recommendations
- After an organization completes the onboarding checklist, relevant security recommendations may be displayed.
- These recommendations highlight best practices designed to maximize Keystrike’s protection, including:
- Disabling email/password-only authentication
- Running all terminators in enforcement mode
- Reviewing and addressing unknown users
- Updating clients if they are running outdated versions
- Updating terminators if they are running outdated versions
- Onboarding checklist updates
- The onboarding checklist has been enhanced to help administrators get up and running faster. Modified steps are:
- Add a second administrator to ensure account continuity.
- Try switching a terminator to Enforcement Mode.
- Trigger an alert while in enforcement mode, to see how unattested activity is blocked and alerted in real time.
- Terminator Bypass - multiple terminators
- A single Terminator Bypass policy can now be applied to multiple terminators, eliminating the need to create separate policies for each one.
- Admin Panel Login methods
- You can now restrict which login methods are allowed — both at the organization level and with overrides for individual administrators.
- Allow Microsoft SSO
- Allow Google SSO
- Allow Email + Password
- Require Multi-Factor-Authentication (MFA)
- For improved security posture, consider the following:
- Make Single Sign-On (SSO) the primary login method by enabling it as the only allowed method at the organization level.
- Maintain a “break-glass” administrator account using Email + Password with MFA enabled through an admin-level override.
- Other improvements
- Minor enhancements.
- Invitations
- Administrators can now send invitations for users to join their Keystrike organization.
- Invited users will receive an email containing a time-limited download link along with a single-use install token.
- This is especially useful for onboarding external vendors, contractors.
- Different install tokens for Clients vs Terminators
- When multi-use install tokens (found in Setups & Installers) are next rotated, separate tokens will now be generated for Clients and Terminators.
- Other improvements
- Minor enhancements.
- Insights - Unknown users
- A new Unknown Users Insight has been introduced. It lists server accounts that are currently active but not mapped to any Keystrike client user.
- These accounts may belong to individuals who do not have the Keystrike client running.
- They could also be legacy accounts that should be reviewed or removed.
- If unknown users are detected, this is highlighted directly on the dashboard.
- Insights - Sessions
- Session insights now include a visual diagram showing which users have been connecting to which servers.
- Alert Display
- Alert lists now show the most recent alert time instead of the first occurrence.
- Alerts also highlight when a recovery code was used during the session.
- Last seen for administrators
- Administrator lists and details now display the last time the administrator was active in the admin panel.
- Other improvements
- General bug fixes and improvements.
Minor admin panel updates in this release include
- Input count in activity log
- "Session end" and "Terminator session end" activities now display the total number of inputs for the respective sessions.
- "Learn more" pages
- Links now open in a new browser tab instead of a popup window.
- Organization search
- For MSPs managing multiple tenants, switching between organizations is now faster and easier.
- Other improvements
- Security enhancements
- General bug fixes
- Live Connectivity and Session Status
- The admin panel now displays real-time connection and session status for users, clients, and terminators. You can immediately see who is currently connected and who is in an active session.
- Active sessions are also highlighted on the overview page.
- Session Insights
- A new "Insights" section has been added to the left menu, beginning with the Sessions page. This initial report provides visibility into user engagement across your organization. Additional reports will be introduced over time, offering deeper insights into various aspects of your organization's Keystrike activity.
- Discontinued Direct User Mapping
- Maintaining three separate user mapping methods—dynamic, predefined, and direct—led to confusion and unexpected edge cases for administrators. To simplify behavior and reduce complexity, direct user mapping has been discontinued. All such cases now fall under dynamic mapping.
- Setup approval for Clients
- It is now possible to require administrator approval for new clients.
- Enabling this setting enhances security by requiring administrators to review and approve new clients and their users before activation.
- When enabled:
- New clients will be registered with a "Pending" status upon initial connection.
- They will remain inactive until explicitly approved by an administrator in the admin panel.
- If this is a user's first client installation, the user will also be registered as "Pending Approval."
- The client application will indicate its pending status and remain unusable until approval is granted.
- Go to Security Policy > Setup Approval in the admin panel to configure.
- Setup approval for Terminators
- It is now possible to require administrator approval for new terminators.
- Enabling this setting enhances security by requiring administrators to review and approve new terminators before activation.
- When enabled:
- New terminators will be registered with a "Pending" status upon initial connection.
- The terminator will remain inactive until explicitly approved by an administrator in the admin panel.
- Go to Security Policy > Setup Approval in the admin panel to configure.
- Suspend and delete
- Users, clients, terminators and administrators can now be suspended and/or deleted. Partially available before, these actions are now available for all of these entities.
- Admin panel information
- The overview page in admin panel highlights if there are any pending clients or terminators waiting activation.
- To promote enabling enforcement mode the ratio of terminators in enforcement mode is highlighted on the overview page.
- Terminator list and terminator details pages display more clearly if terminator is in audit or enforcement mode.
- By default only active entities (user, client, terminator,) are displayed in lists. This filter can then be changed on the page.
- Other updates
- Security updates
- Bug fixes
- Terminator bypass policy
- Terminator Bypass policies are security exceptions that allow specific user accounts on a device to be excluded from Keystrike's protection. These policies enable the terminator on a device to remain in enforcement mode while permitting access for designated accounts that require entry without a Keystrike client.
- Security exceptions should be minimized and reviewed regularly. It is recommended to set an expiration time for each bypass policy to ensure temporary access control.
- Go to Security Policy > Terminator Bypass in the admin panel to configure.
- Delete administrators
- Administrators could previously be suspended, but they can now be permanently deleted.
- Focus on active users
- The Users page now defaults to displaying active users, while still allowing filtering options to view all users or any other status.
- Terminator groups moved
- Terminator groups are now accessible from the left menu instead of a tab on the Terminators page.
- Dynamic user mapping
- When the user account on a client device differs from the one being accessed on a terminator device, user mapping is still required. However, a new dynamic user mapping option has been introduced.
- With dynamic user mapping, when a user remotely connects to a terminator device for the first time (e.g., via RDP or SSH), they must enter a 9-character code displayed on the screen. Keystrike then identifies the client initiating the code entry and establishes a mapping between the two accounts.
- The previously available method of manually defining mappings using regular expressions is now called Predefined user mapping and remains available as an advanced option. Any existing predefined configurations will continue to work.
- For new terminator groups, dynamic user mapping is enabled by default, while predefined mapping is disabled.
- A tab on the Terminator details page shows the active user mapping and provides the option to remove dynamic mappings.
- Both the client and the terminator must be running version 3 or newer for dynamic user mapping.
- Delete terminators
- Terminators that are no longer in use can now be removed from the admin panel.
- MFA status in admin details
- The details page for each administrator displays whether MFA is enabled for that specific admin.
- Activity logs
- OS User ID (os_user_id) has been added to relevant activities, representing the user account's ID on the given device.
- Alert details
- It is now visible in the alert details if inputs in the alert session were caused by; dynamic usermapping being cancelled, the recovery code modal being used or by possible attestation reuse.
- Users page
- The Users page now includes the user ID as a searchable column.
- Administrators search
- A search box has been added to the Administrators page.
- Setup & Installers page
- Instructions have been added for the new Windows client and terminator installers.
- Multi-Factor Authentication (MFA)
- MFA can now be added to an admin account by secret key as well as by QR code.
- Activity Logs
- The input fields Client ID and User have been added to the advanced filters.
- User ID (user_id) is now universal unique identifier (UUID), with the fully qualified username (domain\username) moved to username (uname).
- New activity types Terminator session start and Terminator session end have been added, indicating when someone enters and exits a remote session on a terminator device.
- Terminator type (trm_type) has been added to relevant activities.
- Device name (dev_name) and device ID (dev_id) are now in more activities.
- See the Keystrike Guide for further descriptions (also accessible in the upper right corner in admin panel).
- Other updates
- Bug fixes and cosmetics.
- Admin activity
- It is now possible to see the activity for administrators in a new tab on the admin detail pages.
- Last connection
- The last connection time for terminators has been added as a sortable column on the Terminators page.
- New layouts for detail pages
- The layout of all details pages has been revamped to be more consisten along with improved linking between related information.
- Multi-Factor Authentication (MFA)
- It's now possible for administrators that log in via password to enable MFA
- Client Details
- Details for specific clients can now be viewed by clicking the row in the clients table.
- Recovery codes
- Recovery code usage information is now available under the tab Usage in Recovery codes.
- Version last update
- The date and time of the last update for clients and terminators has been added to detail pages.
- Setup and installers page
- The structure and information on the Setup and installers page has been improved
- Recovery codes
- In case of an emergency it may be necessary to disable enforcement mode for a terminator session by entering a recovery code.
- Information regarding recovery codes can be found under Configuration in the admin panel.
- Role-Based access control (RBAC)
- Different access roles can be assigned to administrators.
- Single Sign On (SSO)
- Microsoft (Azure AD) and Google SSO is now available globally for any organization, does not need to be configured for each organization.
- Admin Details
- It's now possible to see details about a specific administrator by clicking the row in the administrators table.
- Activity log filters
- Advanced filter options added to activity logs.
- Security updates
- Updated third party libraries.
- Activity logs
- It's now possible to filter specific activities and date range on the Activity logs page before exporting. Activity details can be previewed on the page.
- It's possible to export activities in JSON and CSV format.
- More data points for connections and sessions have been included.
- Clients page
- You can now view a list of all installed clients and filter by version.
- Device details
- A details page has been added for each device in the Device list, giving details on the clients or terminators installed on that device.
- User mapping
- Regular expressions used in user mapping are now case insensitive.
- Security updates
- Improved security configs
- Updated third party libraries
- Version Summary:
- A graph displaying the status of installed client and terminator versions is now shown on the Overview page.
- New data for clients and terminators:
- Version and Last connection information now shown for clients and terminators.
- It is now possible to filter by Versions on the Terminators page.
- Devices table improved:
- Devices table now shows number of clients and terminators installed on each device.
- Password reset:
- Administrators can now reset their password themselves if it has been forgotten.
- Alert improvements:
- Enforcement mode status now shown for all alerts.
- Changes made to the columns in the Alerts table.
- Account activation:
- Administrators are now presented with an activation page to finish setting up their accounts.
- Onboarding:
- When entering the admin portal you are now presented with steps to fully set up your organization's account.
- SSO redirect URL has been updated:
- Please take a look at the updated URL in the admin portal under configuration-> SSO->Keystrike callback URL:
User interface update:
Design of the admin panel user interface has been improved for better user experience.
- Terminator groups:
- Terminators groups are new in this release. The purpose of terminator groups is to organize and configure terminators. All terminators belong to exactly one group, the default group if none is specified.
- Terminator config moved to admin panel:
- Terminators are now configured, via terminator groups, in the admin panel instead of in a local terminator config file. Currently this includes enforcement mode and user mapping. Changes are immediately pushed to the terminator.
- Install tokens:
- Install tokens are now required for installing clients and terminators. This token can be found and regenerated in the Setup & Installers page in the admin panel.
- User status:
- Users can be suspended and re-activated. When suspended the user's client(s) can not connect to Keystrike.
- Alerts back in time:
- Alerts can be browsed back in time, by selecting older dates on the alerts overview page.
- Webhook alert details:
- Additional information, device and user information are now sent along with the webhook alerts.
- User interface update:
- Design of the admin panel user interface has been improved for better user experience.
- Zendesk integration:
- Zendesk support has been added to the bottom left side of the Admin panel (Support bubble).
- Users page:
- We have added a Users page that contains a table with all users that have connected a client. By clicking an entry in the table you will see more details about that user as well as information about devices linked to that user.
- Devices page:
- We have improved the Devices page and made it easier to distinguish between client and terminator devices.
- Activity logs:
- It's now possible to see the version of clients and terminators when they make a connection in the activity logs.
- Ability to test SSO configuration:
- Once SSO has been configured you have the ability to click "Test" to see if the SSO was configured correctly.
Ability to disable password login for organizations with SSO configured:
- The ability to toggle enable/disable of password login is now part of the SSO Configuration page in the Admin panel.
- Alerts Details:
- Alert details now show the context of the alerts. This means it's possible to see in which application the alerts occurred and how many alerts were triggered.
- Improved Setup pages:
- The setup pages have been redesigned in a way so that only the information needed to setup Keystrike is displayed and more detailed guidelines can be found by clicking a link in the page or by clicking the Question mark icon in the top right corner and selecting "Keystrike guide".
- Easy access to Release Notes:
- Release notes can now be accessed by clicking the Question mark icon in the top right corner and selecting "Release Notes"
August 24th, 2023August 24th, 2023
- Single Sign-On (SSO) with Google and Azure:
- Admins can now leverage Google and Azure SSO integrations for quick and secure access to the Admin panel.
- Admin Management Enhancements:
- Create Admin:
- Admins can now onboard other admins, streamlining the setup process for Organisations.
- Suspend & Unsuspend Admins:
- Improve security by revoking admin access when needed and reinstating it later.
- Admin Activity in Logs:
- Login activity and update activity performed by admins are now logged in the activity logs. This ensures transparency and can aid in troubleshooting.
- Bug fixes & Improvements
- Improved notifications in the Admin panel.
June 14th, 2023June 14th, 2023
Initial release to production for Pilot customers