Monitor sessions

This topic explains how to access recorded sessions, monitor active sessions, and search and play video recordings.

Privilege Cloud enables you to monitor privileged access to critical systems and applications by creating detailed session audits and video recordings of all IT administrator privileged sessions on remote machines.

All the activities in each privileged session can be recorded in text or video format for future auditing.

You can access recorded sessions from the Privilege Cloud Portal as well as monitor live sessions.

Who can perform these actions? 

You must be assigned to the Privilege Cloud Auditor role to access this page and monitor sessions.

Access recorded sessions

In the Privilege Cloud Portal, click Monitoring.

 

To access recorded sessions, there must be at least one recording or session. The Monitoring menu item does not display if there are no sessions.

In supported regions, the Risk score associated with a session is available with Privileged Detection in Identity Security Intelligence (ISI).

Search video recording

Recordings are displayed in the Recordings grid.

Each recording contains session properties, such as the user who initiated the recording, the start time of the recording and its duration. Your administrator configures which session properties are displayed in the grid.

To search for a video recording:

Use the filters from the Filter pane to search for specific video recordings. You can filter by the following:

Filter

Description

Session Properties

Filter sessions by any property.

Examples include:

  • User
  • Target Address
  • Connection Type

Search multiple properties by separating each entry with a space.

  
root 192.168.0.1

Session Activities

Filter sessions containing specific commands and events:

  • Windows Titles
  • SQL Commands
  • SCP Commands
  • Keystrokes

Search multiple properties by separating each entry with a space.

  
rm sudo top

To search for an exact string, use apostrophes.

  
"ifConfig -a"

Date range

Specify a date and time range.

Play video

When you select a specific session recording, the session details pane appears on the right side of the page. This pane displays recording details such as start time and duration and a timeline of session activities.

To play the video:

Click Play Video. Video recordings are played in an embedded HTML5 video player.

You can play the video from any point in time displayed in the activities timeline.

You can select to automatically skip idle time or skip it manually.

Monitor active sessions

Authorized auditors can monitor active sessions, take part in controlling these sessions, and suspend or terminate them.

You can see the active sessions in the Active Sessions grid.

Each entry contains session properties that describe the session, such as the user who initiated the session, the start time of the session. Your administrator configures which session properties are displayed in the grid.

In addition to viewing the information about the active session, you can do the following:

Activity

Description

Monitor

Open a copy of this active session on your own workstation and view or take part in controlling the session, depending on the system or platform configurations.

Suspend

Suspend an active session.

Resume

Resume a suspended session.

Terminate

Terminates the active session, if you are authorized.

Search for sessions using the filters, as described in Filter.