INSIGHT Status Monitor

The INSIGHT Status Monitor is a local diagnostic utility installed on INSIGHT-managed endpoints. It provides administrators with a direct view of the configurations and settings applied to the endpoint from the management console, and includes tools to generate logs and restart INSIGHT components.

The INSIGHT Status Monitor runs locally and monitors only the device on which it is installed. Typical use cases include:

• Verifying that a configuration or command sent from the management console has been applied to the endpoint.
• Generating logs to investigate unexpected behaviour.
• Restarting an INSIGHT component that is not functioning correctly.

Launching the INSIGHT Status Monitor

1. Open File Explorer and navigate to C:\Program Files (x86)\Guardware\INSIGHT.
2. Right-click GWConsole.exe and select Run as administrator.

   

Dashboard

The Dashboard displays a summary of the endpoint's current configuration and connectivity status. All values are read-only and reflect the settings applied from the management console.

If a configuration does not reflect what was sent from the management console, resend the command from the console and verify again.

Field	Description
Username	The username associated with this endpoint.
Last Updated	The date and time the endpoint's configuration was last updated.
Client Server Interval	The interval at which the client communicates with the server, as configured in the management console.
Report Interval	The interval at which the endpoint sends reports to the server, as configured in the management console.
Report Bandwidth	The bandwidth allocated for reporting, as configured in the management console.
Last Active Time	The date and time the endpoint was last active.
Server	The IP address of the server the endpoint is connected to.
Server Name	The name of the connected server.

View Logs Archive Logs

Archive Logs packages the endpoint's log files into a ZIP archive and saves it to the desktop. The log types included in the archive are determined by the selections made in Log Handling.

1. Click Copy Logs.

   
2. Navigate to your device's desktop and extract the contents of the ZIP file.
3. Open the log files in a text editor.

Log Handling

Log Handling controls which log types are enabled for generation and included when logs are archived via Archive Logs. Toggle on the log types relevant to the issue being investigated before archiving.

Log Type	Description
Debug Engine	Logs related to engine debugging.
Debug Engine Activity	Logs related to engine activity.
Debug Watcher	Logs related to watcher monitoring.
Debug Flag Client Activity	Logs related to flag client monitoring.

App Showdown

App Showdown displays the processes and drivers associated with INSIGHT on the endpoint. Use this section to verify the current state of INSIGHT components and restart any that are not functioning correctly.

Processes

The following processes are listed in App Showdown. Selecting Kill Process next to a process stops it immediately and triggers an automatic restart. This is the recommended approach when a component is behaving unexpectedly or has stopped functioning, and is the equivalent of managing INSIGHT processes via the command line without requiring CLI access.

Process	Description
GWClient.exe	The main communication layer between the endpoint and the INSIGHT server.
GWProxy.exe	Monitors network-level activity on the endpoint.
GWWatcher.exe	Monitors user activity and forwards events for processing.
GWSyncMonitor	[Placeholder]

Drivers

The Drivers section lists the drivers associated with INSIGHT on the endpoint and their current enabled or disabled status. Driver availability and state are controlled from the management console via Devices > Assign Command > Driver Options.

If a driver's status does not reflect the configuration set in the management console, resend the command from Devices > Assign Command and verify again.

Driver	Description
gwpg	Monitors and manages process-level activity related to device interactions. Enforces policy-controlled execution.
gwdogfile	Protects INSIGHT client files and components from unauthorised renaming, modification, or deletion.
gwscanner	Monitors USB activity, detects connected USB devices, captures serial numbers, and tracks usage.
gwusbmon	Monitors file transfers to and from USB devices and captures transferred files for further processing.
gwchatdocmon	Monitors activity in supported chat applications and captures files shared through chat for inspection against configured policies.

Drivers cannot be managed from the INSIGHT Status Monitor. To enable or disable a driver, navigate to Devices > Assign Command > Driver Options in the management console and check or uncheck the box next to the relevant driver name. The updated status is reflected in the INSIGHT Status Monitor once the configuration has been applied to the endpoint.

System Info

System Info displays the endpoint's details and the current status of INSIGHT engine features as applied from the management console. All values are read-only.

If a value does not reflect the expected configuration, resend the relevant command from the management console and verify again.

Field	Description
Browsers.bin	Contains the list of browsers recognised and monitored by INSIGHT. Entries correspond to browser executable names, for example librewolf.exe.
File Upload.ext	Contains the list of file extensions subject to file upload monitoring. Entries define the scope of what is included in upload monitoring, for example INCLUDE.

Engine Settings

Engine Settings displays the current status of INSIGHT engine features on the endpoint. Each value reflects the status as applied from the management console. To modify an engine setting, update the relevant configuration in the management console. [path to be confirmed.]

Setting	Description
Productivity Mode	Indicates whether Productivity Mode is currently active on the endpoint. Possible values: ON, OFF.
Bad App Mode	Indicates whether Bad App Mode is currently active on the endpoint. Possible values: ON, OFF.
Web Productivity Monitor	Indicates the current Web Productivity Monitor value applied to the endpoint.
Browser Mode	Indicates whether Browser Mode is currently active on the endpoint. Possible values: ON, OFF.
USB Monitor	Indicates the current USB monitoring mode applied to the endpoint. Possible values: ON, OFF, PASSIVE.
Outgoing Zip File Mode	[tbc]
Bad App List	[tbc]

Advanced Settings

Advanced Settings displays the list-based configurations applied to the endpoint from the management console. These lists control how INSIGHT monitors and responds to activity across categories, including network traffic, file system activity, and application behaviour. All values are read-only.

To create an Advanced Setting:

1. In the management console, go to INSIGHT > Advanced Settings.
2. Select New Advanced Setting.

To assign an Advanced Setting to an endpoint:

1. In the management console, go to Devices > INSIGHT.
2. Select the device from the list.
3. Select Assign Advanced Setting.

The table below provides an overview of every Advanced Setting and what it does.

Section	What It Does
Report Upload & Communication Settings	Controls the intervals, durations, timeouts, and bandwidth settings for uploading reports and downloading policies and commands.
Applications Monitored at Network Level	Lists applications monitored for sensitive data uploads at the network level.
IP Address Monitored at Network Level	Lists IP addresses included or excluded from network-level monitoring.
Applications with Monitored SSL Traffic	Defines which applications have their SSL traffic monitored when network monitoring is used.
Websites with Monitored SSL Traffic	Defines which websites have their SSL traffic monitored using certificate common names.
Applications with Monitored Keystrokes and Copy/Paste	Specifies applications where keystroke and copy/paste activity is monitored or excluded.
Websites with Monitored Keystrokes and Copy/Paste	Specifies websites where keystroke and copy/paste activity is monitored or excluded.
Applications Monitored at Network Level (LSP)	Lists applications monitored at the network level using the LSP approach.
Status of Client Components	Lists client components and controls whether each is enabled or disabled.
File Extensions Monitored at File System Level	Filters file upload monitoring by file extension type.
Applications Monitored at File System Level	Lists applications monitored for sensitive data uploads at the file system level.
Applications Monitored at File System Level to Provide File Path Information	Lists applications monitored to provide full file path data for network monitoring.
Applications Monitored at File System Level where Repeated Incidents are Ignored	Suppresses repeated incident alerts from specified applications at the file system level.
Applications Hosting Websites with End-to-End Encryption	Lists browser applications monitored at the file system level to intercept file uploads on end-to-end encrypted websites.
Websites with End-to-End Encryption	Lists websites with end-to-end encryption where file system monitoring is required alongside network monitoring.
Browsers Monitored using Chromium Extension	Control which Chromium-based browsers are monitored for sensitive data uploads using a browser extension. When enabled, the extension is installed automatically.
Passive Monitoring of File Uploads to Cloud Drives	Lists cloud drives monitored for sensitive data uploads by tracking file changes in locally synced folders on the device.