GuardWare Components

GuardWare INSIGHT uses several core components that work together on each endpoint to monitor activity, protect data, enforce policies, and keep PCs connected to the Server.

This page explains what each component does and how to enable and disable drivers and proxy/network monitoring.

Drivers

Drivers operate at the system level on the device. They monitor specific activities and help INSIGHT apply security and monitoring rules.

1. GWChatDocMon (File System Monitoring): Monitors activity in supported chat applications. It captures files shared through chat and sends them for inspection based on configured policies. It also handles scenarios such as double encryption during file transfers.
2. GWUsbMon (USB File Transfers): Monitors file transfers to and from USB devices. It captures the files being transferred and sends the relevant data for further processing, supporting data loss prevention (DLP) use cases.
3. GWScanner (USB Monitoring): Monitors USB activity from a productivity perspective. It detects connected USB devices, captures details such as serial numbers, and tracks usage, including devices already connected.
4. GWPG (Process Guardian): Monitors and manages process-level activity related to device interactions, including USB operations, to ensure controlled execution and enforcement of policies.
5. GWDogFile (File Guardian): Protects INSIGHT client files and components. It prevents unauthorised renaming, modification, or deletion of critical client files to maintain system integrity.

GWClient

GWClient acts as the primary communication layer between the endpoint and the INSIGHT server.

• Establishes and maintains communication between the server and the endpoint.
• Downloads and applies policies, user settings, and configuration updates from the server.
• Sends system status, logs, and activity data back to the server.
• Handles commands from the server, such as policy updates or actions.
• Maintains handshake status (for example, whether endpoints are online).
• Updates local configurations, including registry settings, and distributes them to other components.

GWW (Watcher)

GWW monitors user activity on the endpoint and acts as an intermediary between drivers and higher-level processing components.

• Monitors activities such as typing, file access, viewing, and printing.
• Detects sensitive data usage based on configured keywords or policies.
• Receives input from drivers and forwards it to the processing engine (engine DLL).
• Coordinates with other components to enforce policies based on detected activity.

GWProxy

GWProxy monitors network-level activity on the endpoint.

• Tracks network traffic generated by applications.
• Enables inspection and control of data being transmitted over the network.
• Supports the enforcement of policies related to web and network usage.

These components work together to provide endpoint monitoring, data protection, and policy enforcement within GuardWare INSIGHT.

Enable or Disable Drivers

You can enable or disable specific drivers based on your organisation’s requirements.

Disable drivers only when required, such as troubleshooting system or application issues, resolving compatibility problems, or testing performance.

Disabling drivers can reduce monitoring and control capabilities, so disable only the required driver.

1. Log in to the GuardWare Management Console.
2. Navigate to Devices.
3. Select the device where you want to enable or disable drivers and click Assign Command.

   
4. Scroll down and select Driver Options.
5. Deselect a driver to disable and select to enable. Enable or disable the required driver.
6. Click Confirm.

Enable or Disable Network Monitoring

You can enable or disable network monitoring, or switch between available modes based on your deployment and monitoring requirements.

Disable network monitoring only when required, such as during troubleshooting network or connectivity issues, resolving conflicts with network-level tools, or when network monitoring is not needed.

Disabling network monitoring stops traffic monitoring and enforcement, so it should be done with caution.

1. Log in to the GuardWare Management Console.
2. Navigate to Devices.
3. Select the device where you want to enable or disable drivers and click Assign Command.

   
4. Scroll down and select Network Monitoring Approach.
5. By default, INSIGHT uses the Windows Filtering Platform (WFP) approach to monitor network traffic. If there is an incompatibility with another network monitoring application, you can either switch to LSP or turn off network monitoring.

   • LSP: Enables network monitoring using Layered Service Provider for traffic interception.
   • WFP: Enables network monitoring using Windows Filtering Platform.
   • Off: Disables network monitoring.

   

6. Click Confirm.