Patent ID: 8433791

Claim:
An apparatus configured to monitor and audit activity in a network, the network utilizes an incremental screen protocol, the apparatus comprising: a) an analyzer being configured to analyze intercepted packets, wherein the packets are conveyed between entities in the network other than the apparatus, and being configured to generate analyzed data based on information associated with at least some of the packets, the analyzed data being indicative of sessions and being indicative of the incremental screen protocol used in each of the sessions; b) a mirror manager being incrementally updated to reflect mirror data, the mirror data including information indicative of a most recent change in an on-screen field location of data responsive to the intercepted packets; c) a data storage unit comprising a non-transitory computer-readable medium accessible thereto for storing the data indicative of sessions and being indicative of the incremental screen protocol; and d) an audit event analyzer being responsive to the mirror data, the audit event analyzer being configured to generate event data representative of audit events between the other entities in the network, the event data including characteristics relating to the on-screen field location of data being part of the audit events, the on-screen field location being representative of at least one operation performed in the network.