# Introduction
The Twosense documentation contains information to help you deploy Twosense to your organization and troubleshoot any issues you may run into.
This documentation is organized by software component. To view documentation for a specific component of the Twosense product, switch from the dropdown at the top of the page. You can search all documentation at once using the search bar in the top-right of the page.
# System Requirements
### Windows Agent
* A supported 64-bit Windows version
* Windows 10 version 1803 (OS build 17134) or later
* Windows 11
* Dual-core processor
* 2GB RAM
* Domain joined (Active Directory or EntraID)
* Continuous internet connectivity
{% hint style="info" %}
In VDI environments, the Twosense agent can be installed onto a virtual machine.
{% endhint %}
***
### Browser Extension (SSO Integration)
Chrome or Edge browser, latest stable version
# FAQ
### Privacy
**What data does the Twosense agent collect?**\
Twosense measures behavioral data such as typing cadence and mouse movements continuously throughout the day.
**Are my keystrokes being logged somewhere?**\
Keystrokes and the resulting characters entered are not collected, with no mechanism for a User, Administrator, or Twosense employee to see what has been typed. Our system collects on the "how" of typing, not the "what" that was typed.
**Does Twosense use my webcam or microphone?**\
No, Twosense does not use a webcam or a microphone, does not collect audio or visual data, nor require the hardware to be present.
**Does Twosense keep track of when I’m at my computer, or any other performance tracking?**\
Twosense is not productivity software. We only report a list of authentication events and whether or not the MFA challenge was successfully automated.
***
### Functionality
**How long does it take to start working?**\
Like any machine-learning system, it takes time before your unique behavior can be effectively modeled. For most users, some behavioral signals will have been learned within a day or two, with all users complete in under two weeks under normal usage.
**Can users be locked out of applications if Twosense goes down?**\
If Twosense’s cloud service is unavailable, all users will be directed to traditional MFA workflows (the same ones they are using today.)
**Does Twosense need sensitive access to the IdP or SSO?**\
No administrative access or keys are required. Twosense functions as a multifactor provider, which an Administrator will need to initially configure. From that point onwards, no further access is needed.
**Can Twosense be rolled out to a specific group of users?**\
Yes. Twosense is configured as an MFA factor that gets added to a policy. That policy can then be applied to any group of users.
**Can Twosense be used for remote employees?**\
Yes. Twosense is designed to be used for both secure facilities and remote agents.
# Anti-Virus Configuration
Learn how to explicitly allow Twosense software in your anti-virus solution to avoid issues.
## Anti-Virus Configuration
Due to the deeply integrated nature of the Twosense agent software, heuristic analysis from anti-virus engines may erroneously classify components of it as malware. If this happens, the anti-virus may attempt to quarantine the software and cause issues with the machine.
If your organization uses an endpoint protection solution or other form of anti-virus, please allow-list the following paths to prevent issues. Refer to your vendor's documentation on how to properly exempt paths from detection and quarantine.
* `C:\Program Files\TWOSENSE.AI\*`
* `C:\Windows\system32\drivers\kbfiltr.Sys`
* This driver is a keyboard filter which allows the Twosense agent to capture typing behavior during Windows login. To verify its authenticity, you may check the digital signature — it should be signed by Microsoft.
## Network and Firewall Configuration
Outgoing connections to the following hosts should be allow-listed. Depending on your use case, you may be provided a more specific list of hostnames by your account manager.
* `api.twosense.ai`
* `apiv2.twosense.ai`
* `endpoint-management.twosense.ai`
* `app.twosense.ai`
* `webapi.twosense.ai`
* `manager-approval.twosense.ai`
* `sentry.twosense.ai`
* `o386114.ingest.sentry.io`
* `logs.us-east-1.amazonaws.com`
* `monitoring.us-east-1.amazonaws.com`
* `api.mixpanel.com`
* `radius.twosense.ai`
# Diagnostic Tool
If you reach out to Twosense for support, you may be asked to run the Twosense Diagnostic Tool. It is a PowerShell script that runs a suite of self-tests, collects basic information about the system (such as OS version, domain-joined status, etc.), and copies logs from installed Twosense software to a single zip file that can be sent back to Twosense for further investigation.
To run the tool, follow these steps on the machine that is experiencing the issue:
1. If possible, sign in as the user experiencing the issue.
2. Open a new PowerShell window **as administrator**.
3. Navigate to a directory where you want the diagnostic information to be saved (such as the desktop, for example).
4. Paste the following one-liner into the window and run it:
```powershell
Set-ExecutionPolicy RemoteSigned -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://twosense-public.s3.amazonaws.com/TwosenseDiagnosticTool.ps1'))
```
{% hint style="info" %}
If you wish to inspect the contents or verify the integrity of the script before execution, you can download it directly from the URL above. The script is digitally signed by Twosense; you may verify this under **File Properties -> Digital Signatures**.\
\
{% endhint %}
Once the diagnostic tool is finished, it will offer to send the information to the Twosense team. After entering your details, the diagnostic information will automatically be sent to us for further inspection. If you're having trouble with the automatic upload process, you can attach the generated zip file to an email instead.
# Introduction
Twosense can be integrated into an IdP using either a deployed browser extension or by embedding it directly in your login page using the Twosense SDK. This documentation provides requirements, guides, and troubleshooting info to make your Twosense deployment as smooth as possible.
If you are just getting started, visit the guide for your preferred method of deployment:
* [Extension + PingFederate Integration Guide](/browser-extension-sdk/browser-extension/ping-integration)
* [SDK + PingFederate Integration Guide](/browser-extension-sdk/sdk/ping-integration)
# Extension + Delinea Integration Guide
### What You'll Need to do
There are two main steps you’ll need to follow to complete the deployment. Total time is usually under 30 minutes.
* Install the Twosense browser extension into Chrome or Edge for all users that will be utilizing Twosense as a factor.
* Configure Secret Server to use Twosense as an MFA factor.
***
### Prerequisites
* A Secret Server or Secret Server Cloud instance. If you don't have one, Delinea offers free trials [here](https://thycotic.com/products/secret-server/start-a-trial/).
* An account or active trial with Twosense. Please contact us [here](https://www.twosense.ai/demo) to obtain a 30-day trial if you don’t have one already.
* The **API Hostname**, **Integration Key**, and **Secret Key** provided by your Twosense account manager.
***
### Step-by-step
1. Edit the application settings configuration file.\
This is on the web application server and in a default installation would be named\
`C:\inetput\wwwroot\SecretServer\web-appSettings.config`
2. The file is an XML configuration file.\
To enable the TwoSense integration add the following line somewhere between `` and ``:\
\
``\
\
The new file should look something like this (assuming no other edits have been made in the past)\
\
``\
``\
``\
``
3. **Save** the configuration file.
4. Run an **IISReset** on the server to restart the application with the new setting.
5. Log in to Secret Server and navigate to **Admin** -> **Configuration**
6. On the ‘Login’ tab you will now see an option for **Enable TWOSENSE.AI Integration**, it will be defaulted to ‘**No**’.
7. **Edit** the login configuration page.
8. Check the box next to **Enable TWOSENSE.AI Integration**.
9. An additional configuration option will appear. Add the **API Hostname**, **Integration Key**, and **Secret Key** provided by your Twosense account manager.
10. The Twosense browser extension will begin building user profiles and automating MFA challenges. Your organization’s dashboard at will show progress as the machine learning models improve and MFA challenges are automated
# Extension + OneLogin Integration Guide
### What You'll Need to do
There are two main steps you’ll need to follow to complete the deployment. Total time is usually under 30 minutes.
* Install the Twosense browser extension into Chrome or Edge for all users that will be utilizing Twosense as a factor.
* Configure Twosense as a factor in OneLogin and apply the policy to users.
***
### Prerequisites
* A OneLogin organization. If you don't already have one, you can get a free account at
* An account or active trial with Twosense. Please contact us [here](https://www.twosense.ai/demo) to obtain a 30-day trial if you don’t have one already.
* The **Hostname**, **Port Number**, and **Shared Secret** provided by your Twosense account manager.
***
### Step-by-step
Add Twosense as a RADIUS factor:
1. Click “**New Auth Factor**” in the upper right corner\
2. Select "**RADIUS**" as the new factor type:\
3. Under "User Description" name the new factor **TWOSENSE**.\
Note: this value must be exactly "TWOSENSE" for the integration to function properly.\
4. Use the **Hostname**, **Port Number**, and **Shared Secret** provided by Twosense for this step.\
5. Navigate to **Security > Policies**, select the policy you want to add Twosense to, and enable it as an OTP Auth factor:\
6. Ensure that the policy is applied to “All users” of this policy, not “Administrator Only.”\
7. **Save** the changes made to the policy.
{% hint style="info" %}
**NOTE**: Users never need to manually choose the TWOSENSE factor. If a user has the Twosense browser extension installed and belongs to a Policy with Twosense as a factor, each time they pass an MFA check the Twosense factor will automatically be prioritized for their next authentication.
{% endhint %}
# Extension + Okta Integration Guide
### What You'll Need to do
There are two main steps you’ll need to follow to complete the deployment. Total time is usually under 30 minutes.
* Download the On-Prem MFA Agent from the Okta administrative dashboard.
* Install the On-Prem MFA Agent. Configure the agent with the values provided by your Twosense account manager.
***
### Prerequisites
* An Okta Org. If you don't already have one, you can get a free account at
* An account or active trial with Twosense. Please contact us [here](https://www.twosense.ai/demo) to obtain a 30-day trial if you don’t have one already.
* You will need an Okta account with organization level privileges to install the Okta On-Prem MFA Agent.
* Provide your Twosense account manager the IP address of the server that will be running the Okta On-Prem MFA Agent.
* The **Radius host**, **port**, and **shared secret** provided by your Twosense account manager.
***
### Step-by-step
1. Log in to your Okta instance with an administrator account.
2. Navigate to **Security** → **Multifactor**, then select **On-Prem MFA** in the navigation menu.
3. Click **Add New Agent**.
4. Use the **Download the agent** link provided in this window to download the On-Prem MFA agent. Make note of the Instance ID provided to you. It will be used during the installation.
5. Run the downloaded agent on your Microsoft Windows server. You may need to adjust IE security settings to allow interaction with the Okta website during this process. Follow the step-by-step installation until it is completed.
6. Once the installation is complete, you should edit the **On-Prem Multifactor Authentication Settings** within the same page where you downloaded the agent. The following settings will need to be configured:
* Provider username format: Okta username
* Hostname: Provided by your Twosense account manager
* Authentication Port: Provided by your Twosense account manager
* Shared Secret: Provided by your Twosense account manager
# Extension + PingFederate Integration Guide
## System Requirements
* For Twosense to work properly, service providers must be configured to receive SAML responses as POST, not GET.
## Introduction
Use this guide to add Twosense MFA to your PingFederate SSO authentication flow. The following configuration steps are required:
* [Create RADIUS Password Credential Validator](#create-radius-password-credential-validator)
* [Create Twosense MFA IdP Adapter](#create-twosense-mfa-idp-adapter)
* [Modify the primary authentication adapter to return the userSid](#modify-the-primary-authentication-adapter-to-return-the-usersid)
* [Modify the primary authentication HTML form](#modify-the-primary-authentication-html-form)
* [Create HTTP Header Authentication Selector](#create-http-header-authentication-selector)
* [Create Authentication Policy](#create-authentication-policy)
## Create RADIUS Password Credential Validator
1. Navigate to **SYSTEM** and select **Password Credential Validators**.
2. Click **Create New Instance**.
3. In the **Type** tab, set the following:
* *Instance Name*: **Twosense MFA RADIUS PCV**
* *Instance ID*: **TwosenseMfaRadiusPcv**
* *Type*: **RADIUS Username Password Credential Validator**
* Click **Next**.
4. In the **Instance Configuration** tab, click **Add a new row to 'RADIUS Servers'**, and set the following:
* *Hostname*: **radius.twosense.ai**
* *Authentication Port*: **{Provided by Twosense}**
* *Authentication Protocol*: **PAP**
* *Shared Secret*: **{Provided by Twosense}**
* Click **Update**.
* Click **Next**.
5. In the **Extended Contract** tab, click **Next**.
6. Review the **Summary** tab, and click **Save**.
## Create Twosense MFA IdP Adapter
This adapter will be used by the Twosense browser extension to automate MFA requests.
1. Copy the `html.form.twosense.mfa.html` and `html.form.twosense.challenge.html` files from the setup package to your PingFederate instance under `pingfederate/server/default/conf/template/`.
2. Navigate to **AUTHENTICATION** and select **IdP Adapters**.
3. Click **Create New Instance**.
4. In the **Type** tab, set the following:
* *Instance Name*: **Twosense MFA Form**
* *Instance ID*: **TwosenseMfaForm**
* *Type*: **HTML Form IdP Adapter**
* Click **Next**.
5. In the **IdP Adapter** tab, under **Password Credential Validator Instance**, click **Add a new row to 'Credential Validators'**:
* Select **Twosense MFA RADIUS PCV**
* Click **Update**.
* Set the following fields:
* *Challenge Retries*: **1**
* Click **Show Advanced Fields**.
* *Login Template*: **html.form.twosense.mfa.html**
* *Login Challenge Template*: **html.form.twosense.challenge.html**
* *Allow Username Edits During Chaining*: **true**
* *Fail Authentication on Account Lockout*: **true**
* Click **Next**.
6. In the **Extended Contract** tab, click **Next**.
7. In the **Adapter Attributes** tab, check the **Pseudonym** checkbox for the **username** attribute, and click **Next**.
8. In the **Adapter Contract Mapping** tab, click **Configure Adapter Contract**.
1. In the **Attribute Sources & User Lookup** tab, click **Next**.
2. In the **Adapter Contract Fulfillment** tab, click **Next**.
3. In the **Issuance Criteria** tab, click **Next**.
4. In the **Summary** tab, click **Done**.
5. Click **Next**.
9. Review the **Summary** tab, and click **Save**.
## Modify the primary authentication adapter to return the userSid
The Twosense MFA adapter requires the user's `objectSid` attribute. In order to do this, we need to extend the contract of the primary login form IdP adapter.
1. Navigate to **AUTHENTICATION** and select **IdP Adapters**.
2. Click on the IdP adapter of your primary login HTML form.
3. In the **Summary** tab, click **Extend Contract**.
1. Under **Extend the Contract**, add the **objectSid** attribute.
2. Navigate back to the **Summary** tab.
4. In the **Summary** tab, click **Attribute Sources & User Lookup**.
1. In the **Attribute Source & User Lookup** tab, click **Add Attribute Source**.
1. In the **Data Store** tab, set the following:
* *ATTRIBUTE SOURCE ID*: **ActiveDirectory** (or another descriptive name)
* *ATTRIBUTE SOURCE DESCRIPTION*: **Active Directory** (or another descriptive name)
* *ACTIVE DATA STORE*: **{Your Active Directory Datastore}**
* Click **Next**.
2. In the **LDAP Directory Search** tab, set the following:
* *BASE DN*: **{Your Active Directory Search Base DN}**
* *Attributes to return from search*: **objectSid**
* Click **Next**.
3. In the **LDAP Binary Attribute Encoding Types** tab, select **SID** as the *Attribute Encoding Type* for *objectSID*, and click **Next**.
4. In the **LDAP Filter** tab, set **FILTER** to **sAMAccountName=${username}**, click **Next**.
5. In the **Summary** tab, click **Done**.
2. In the **Attribute Source & User Lookup** tab, click **Next**.
3. In the **Adapter Contract Fulfillment** tab, for **objectSid**:
* Select **LDAP (Active Directory)** as the *Source*.
* Select **objectSid** as the *Value*.
* Click **Next**.
4. In the **Issuance Criteria** tab, click **Next**.
5. In the **Summary** tab, click **Done**.
5. In the **Adapter Contract Mapping** tab, click **Save**.
## Modify the primary authentication HTML form
The Twosense browser extension detects the presence of the primary login form by looking for a specific attribute in the HTML form. In order to do this, we need to modify the primary login form.
1. Navigate to **AUTHENTICATION** and select **IdP Adapters**.
2. Click on the IdP adapter of your primary login HTML form.
3. Find the name of the HTML form file by looking for the **Login Template** field in the **Summary** tab. The default value is `html.form.login.template.html`.
4. Find the file on your PingFederate instance under `pingfederate/server/default/conf/template/`.
5. Modify the HTML form to include the following attribute in the ` ` tag, add the following lines:
{% code overflow="wrap" %}
```html
```
{% endcode %}
{% hint style="warning" %}
You will need to embed the Twosense client script on each primary login form template where you want Twosense to be active.
Please note that the location of this snippet matters; it **must** be added before the closing `` tag, not in `