Deploying or configuring session recording for all privileged access to critical servers and databases
Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring
Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions
Implementing real-time alerting for high-risk commands executed during privileged sessions
Establishing a forensic audit trail of all administrative actions on production infrastructure
Do not use for monitoring standard user sessions or endpoint activity; use EDR/UBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.
Prerequisites
CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured
CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows/Linux jump server
Network architecture where all privileged access is routed through the PSM proxy (no direct RDP/SSH to targets)
PVWA (Password Vault Web Access) deployed and accessible for session review
Active Directory integration for authenticating PAM users
Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)
Alternatively for open-source: Teleport, Apache Guacamole with session recording, or script/ttyrec for Linux
Workflow
Step 1: Architecture — Route All Privileged Access Through PSM
Ensure no direct privileged access bypasses the recording proxy:
Architecture Overview:
Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server
│ │ │
│ Credentials never │ Session is │
│ exposed to admin │ recorded and │
│ │ stored in Vault │
└── MFA + AD Auth ──────────────────> │ │
└── RDP/SSH proxy ──>│
Network Controls:
- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks
- Firewall: ALLOW RDP/SSH to target servers ONLY from PSM server IPs
- Firewall: ALLOW PVWA access (443) from admin user networks
- PSM server: Hardened, no internet access, local admin access restricted
Step 2: Configure PSM Connection Components
Define how PSM connects to target systems. In the PVWA administration console:
PVWA > Administration > Configuration > Connection Components
For Windows RDP targets:
Connection Component: PSM-RDP
Protocol: RDP
Client Application: mstsc.exe
Recording Settings:
Record Sessions: Yes
Recording Format: AVI (video) + Keystrokes (text)
Record Windows Titles: Yes
For Linux SSH targets:
Connection Component: PSM-SSH
Protocol: SSH
Client Application: PSM-SecureCRT or PSM-Putty
Recording Settings:
Record Sessions: Yes
Recording Format: AVI + Text commands
Record Unix Commands: Yes
For Database targets (SQL Server Management Studio):
Connection Component: PSM-SSMS
Protocol: Custom
Client Application: SSMS.exe
Recording Settings:
Record Sessions: Yes
Record SQL Queries: Yes (via keystroke logging)
Step 3: Configure Session Recording Policies
Define recording rules based on risk level and compliance requirements:
PVWA > Administration > Platform Management > [Platform] > Session Management
Session Recording Settings:
Enable Session Recording: Yes
Recording Type: Record and Save (not just Monitor)
Keystroke Logging:
Enable Transcript: Yes
Enable Window Events: Yes
Storage:
Recordings Storage Location: Vault (encrypted, tamper-proof)
Retention Period: 90 days (adjust per compliance requirement)
PCI-DSS: Retain for 1 year, available for 3 months
SOX: Retain for 7 years
HIPAA: Retain for 6 years
Compression:
Enable Recording Compression: Yes
Compression Level: Medium (balance storage vs. quality)
For granular control, configure per-safe recording policies:
Safe: Production-Servers-Admin
Record all sessions: Yes
Safe: Development-Servers
Record all sessions: No (optional for non-production)
Safe: Third-Party-Vendor-Access
Record all sessions: Yes
Enable real-time monitoring: Yes
Require dual authorization: Yes
Step 4: Enable Real-Time Session Monitoring
Configure live session monitoring for SOC analysts:
PVWA > Monitoring > Privileged Session Monitoring
Live Monitoring Dashboard:
- Active Sessions: Shows all current privileged sessions in real-time
- Session Details: User, target, duration, risk score
- Actions Available:
- Watch: View the session in real-time (read-only)
- Suspend: Temporarily freeze the session
- Terminate: Immediately end the session
Configure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):
PTA > Configuration > Security Events
Rule: High-Risk Command Detected
Trigger: Unix command matches pattern
Patterns:
- rm -rf /
- chmod 777
- iptables -F
- useradd
- passwd root
- dd if=/dev/
- wget http* | sh
- curl * | bash
- nc -e /bin/sh
- python -c 'import socket,subprocess'
Action: Alert SOC + Flag session as high-risk
Rule: Credential Access Attempt
Trigger: Windows process matches
Patterns:
- mimikatz.exe
- procdump.exe targeting lsass
- ntdsutil.exe
- secretsdump
Action: Terminate session + Alert SOC + Lock account
Rule: Unusual Session Duration
Trigger: Session duration exceeds 4 hours
Action: Alert SOC for review
Step 5: Configure Session Review Workflow
Set up the post-session review process for auditors:
PVWA > Recordings > Search and Review
Search Filters:
- Date range
- Target server
- User who initiated the session
- Safe name
- Session risk score (from PTA)
- Session duration
Review Workflow:
1. Auditor opens recorded session in PVWA HTML5 player
2. Video playback with timeline scrubbing
3. Keystroke transcript displayed alongside video
4. Window title log shows which applications were opened
5. Risk events are highlighted on the timeline with markers
6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation
Fast-Forward Features:
- Jump to keystrokes (skip idle time)
- Jump to risk events (flagged by PTA)
- Text search within keystroke transcript
- Filter by window title changes
Step 6: Open-Source Alternative — Teleport for Session Recording
For environments without CyberArk, Teleport provides session recording for SSH, RDP, and Kubernetes:
# /etc/teleport.yaml - Session recording configurationteleport:nodename:teleport-proxy.corp.internaldata_dir:/var/lib/teleportauth_service:enabled:yessession_recording:"node-sync"# Record at the node level, sync to auth server# Session recording storage (S3 for production)audit_sessions_uri:"s3://teleport-session-recordings/sessions?region=us-east-1"# Enhanced session recording (captures commands even in nested shells)enhanced_recording:enabled:truecommand_events:truenetwork_events:truedisk_events:truessh_service:enabled:yesenhanced_recording:enabled:trueproxy_service:enabled:yesweb_listen_addr:0.0.0.0:443
Query recorded sessions with tsh:
# List recorded sessions
tsh recordings ls --from=2026-03-15 --to=2026-03-19
# Play back a specific session
tsh play <session-id>
# Export session events as JSON (for SIEM ingestion)
tsh recordings export <session-id> --format=json > session_events.json
# Search for sessions containing specific commands
tsh recordings ls --query='command == "rm -rf"'
Step 7: Forward Session Metadata to SIEM
Send session events and alerts to the SIEM for correlation with other security data:
