View Source

The section is intended to search and view active and finished sessions.

Session search

Search is performed in the All sessions section.

Quick search

Enter in the search box fully or partially User, Resource Account name or Connectoin type.

Extended Search

Click Extended search and select one or more criteria:

Date and time Form
Date and time To
Account
Resource
Resource group
User

Select session State:

Active
Aborted
Finished

Select Connection type:

RDP
SSH
User connection

Dumping the session log to a file

Events can be unloaded into two types of files: CSV and XSLX. To download the log, click on the corresponding button.

The report is generated in the form of a table with columns: "User", "Account name", "Resource", "Duration", "Connection type", "Started at", "Finished at", "Status".

Only the last 10,000 records are dumped.

Session profile

Indeed Privileged Access Manager 2.3 Documentation > All sessions > LogSessionProfile.png

The following data is displayed for each session:

User - the user of the Active Directory that initiated the session.
Account - an account that is used to open an RDP, SSH, or web session.
Resource - a resource on which RDP, SSH or web-session was opened on behalf of the account.
Reason - is the reason for connecting to the resource.
Duration - the duration of the session in hours, minutes, and seconds.
Connection type - the type of connection to the resource that is used by local or domain accounts to open a session
Started at - the date and time the session opened.
Finished at - the date and time of closing the session.
State - the current state of the session.
Permission created at - the date and time the permission was created.
Permission created by - Indeed PAM Administrator Account.
Comment - the permission description specified at the creation stage.