GuardWare Components

GuardWare INSIGHT uses several core components that work together on each endpoint to monitor activity, protect data, enforce policies, and keep PCs connected to the Server.

This page explains what each component does and how to enable and disable drivers and proxy.

Drivers

Drivers operate at the system level on the device. They monitor specific activities and help INSIGHT apply security and monitoring rules.

1. GWChatDocMon: Monitors activity in supported chat applications. It captures files shared through chat and sends them for inspection based on configured policies. It also handles scenarios such as double encryption during file transfers.
2. GWUsbMon: Monitors file transfers to and from USB devices. It captures the files being transferred and sends the relevant data for further processing, supporting data loss prevention (DLP) use cases.
3. GWScanner: Monitors USB activity from a productivity perspective. It detects connected USB devices, captures details such as serial numbers, and tracks usage, including devices already connected.
4. GWPG: Monitors and manages process-level activity related to device interactions, including USB operations, to ensure controlled execution and enforcement of policies.
5. GWDogFile: Protects INSIGHT client files and components. It prevents unauthorised renaming, modification, or deletion of critical client files to maintain system integrity.
6. GWWFP.sys: Monitors network traffic at the system level. It inspects both standard and SSL/TLS-encrypted traffic (where supported) to detect sensitive information based on configured policies. This enables real-time visibility and control over data transmitted across applications and network connections, supporting data loss prevention (DLP) and network monitoring.

GWClient

GWClient acts as the primary communication layer between the endpoint and the INSIGHT server.

• Establishes and maintains communication between the server and the endpoint.
• Downloads and applies policies, user settings, and configuration updates from the server.
• Sends system status, logs, and activity data back to the server.
• Handles commands from the server, such as policy updates or actions.
• Maintains handshake status (for example, whether endpoints are online).
• Updates local configurations, including registry settings, and distributes them to other components.

GWW (Watcher)

GWW monitors user activity on the endpoint and acts as an intermediary between drivers and higher-level processing components.

• Monitors activities such as typing, file access, viewing, and printing.
• Detects sensitive data usage based on configured keywords or policies.
• Receives input from drivers and forwards it to the processing engine (engine DLL).
• Coordinates with other components to enforce policies based on detected activity.

GWProxy

GWProxy monitors network-level activity on the endpoint.

• Tracks network traffic generated by applications.
• Enables inspection and control of data being transmitted over the network.
• Supports the enforcement of policies related to web and network usage.

These components work together to provide endpoint monitoring, data protection, and policy enforcement within GuardWare INSIGHT.

Enable or Disable Drivers

You can enable or disable specific drivers based on your organisation’s requirements.

Disable drivers only when required, such as troubleshooting system or application issues, resolving compatibility problems, or testing performance.

Disabling drivers can reduce monitoring and control capabilities, so disable only the required driver.

1. Log in to the INSIGHT Management Console.
2. Navigate to PC Group and right-click the required PC.
3. Click Advance Settings > Driver Options.

   
4. Enable or disable the required driver.
5. Click Submit.

Enable or Disable Proxy

You can enable or disable proxy monitoring, or switch between available modes based on your deployment and monitoring requirements.

Disable Proxy only when required, such as during troubleshooting network or connectivity issues, resolving conflicts with network-level tools, or when network monitoring is not needed.

Disabling Proxy stops traffic monitoring and enforcement, so it should be done with caution.

1. Log in to the INSIGHT Management Console.
2. Navigate to PC Group and right-click the required PC.
3. Click Advance Settings > Proxy Status.

   
4. Select the required option:

   • LSP: Enables proxy using Layered Service Provider for traffic interception.
   • WFP: Enables proxy using Windows Filtering Platform.
   • Off: Disables proxy monitoring.
5. Click Submit.