[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVCQD7PDFKC7CMARFRZMQK":3,"skill-same:01M6EVCQD7PDFKC7CMARFRZMQK":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6EVCQD7PDFKC7CMARFRZMQK","implementing-privileged-session-monitoring",null,"Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-privileged-session-monitoring\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"monitoring","session","implementing privileged session monitoring","privileged-session","session analysis","time","access","open","analysis","session-monitoring","session-recording","cybersecurity","PSM","cyberark","PAM","t1098","real-time","risk","t1078","pr","2026-11-10 10:12:30",false,"---\nname: implementing-privileged-session-monitoring\ndescription: 'Implements privileged session monitoring and recording using Privileged\n  Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager\n  (PSM) and open-source alternatives. Covers session recording configuration, keystroke\n  logging, real-time monitoring, risk-based session analysis, and compliance audit\n  trail generation. Activates for requests involving privileged session recording,\n  PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring,\n  or compliance session auditing.\n\n  '\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- PAM\n- CyberArk\n- PSM\n- privileged-session\n- session-recording\n- session-monitoring\n- compliance\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n---\n\n# Implementing Privileged Session Monitoring\n\n## When to Use\n\n- Deploying or configuring session recording for all privileged access to critical servers and databases\n- Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring\n- Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions\n- Implementing real-time alerting for high-risk commands executed during privileged sessions\n- Establishing a forensic audit trail of all administrative actions on production infrastructure\n\n**Do not use** for monitoring standard user sessions or endpoint activity; use EDR\u002FUBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.\n\n## Prerequisites\n\n- CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured\n- CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows\u002FLinux jump server\n- Network architecture where all privileged access is routed through the PSM proxy (no direct RDP\u002FSSH to targets)\n- PVWA (Password Vault Web Access) deployed and accessible for session review\n- Active Directory integration for authenticating PAM users\n- Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)\n- Alternatively for open-source: Teleport, Apache Guacamole with session recording, or `script`\u002F`ttyrec` for Linux\n\n## Workflow\n\n### Step 1: Architecture — Route All Privileged Access Through PSM\n\nEnsure no direct privileged access bypasses the recording proxy:\n\n```\nArchitecture Overview:\n\n  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server\n       │                                     │                     │\n       │         Credentials never           │   Session is        │\n       │         exposed to admin            │   recorded and      │\n       │                                     │   stored in Vault   │\n       └── MFA + AD Auth ──────────────────> │                     │\n                                              └── RDP\u002FSSH proxy ──>│\n\nNetwork Controls:\n- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks\n- Firewall: ALLOW RDP\u002FSSH to target servers ONLY from PSM server IPs\n- Firewall: ALLOW PVWA access (443) from admin user networks\n- PSM server: Hardened, no internet access, local admin access restricted\n```\n\n### Step 2: Configure PSM Connection Components\n\nDefine how PSM connects to target systems. In the PVWA administration console:\n\n```\nPVWA > Administration > Configuration > Connection Components\n\nFor Windows RDP targets:\n  Connection Component: PSM-RDP\n  Protocol: RDP\n  Client Application: mstsc.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI (video) + Keystrokes (text)\n    Record Windows Titles: Yes\n\nFor Linux SSH targets:\n  Connection Component: PSM-SSH\n  Protocol: SSH\n  Client Application: PSM-SecureCRT or PSM-Putty\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI + Text commands\n    Record Unix Commands: Yes\n\nFor Database targets (SQL Server Management Studio):\n  Connection Component: PSM-SSMS\n  Protocol: Custom\n  Client Application: SSMS.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Record SQL Queries: Yes (via keystroke logging)\n```\n\n### Step 3: Configure Session Recording Policies\n\nDefine recording rules based on risk level and compliance requirements:\n\n```\nPVWA > Administration > Platform Management > [Platform] > Session Management\n\nSession Recording Settings:\n  Enable Session Recording: Yes\n  Recording Type: Record and Save (not just Monitor)\n\n  Keystroke Logging:\n    Enable Transcript: Yes\n    Enable Window Events: Yes\n\n  Storage:\n    Recordings Storage Location: Vault (encrypted, tamper-proof)\n    Retention Period: 90 days (adjust per compliance requirement)\n\n    PCI-DSS:  Retain for 1 year, available for 3 months\n    SOX:      Retain for 7 years\n    HIPAA:    Retain for 6 years\n\n  Compression:\n    Enable Recording Compression: Yes\n    Compression Level: Medium (balance storage vs. quality)\n```\n\nFor granular control, configure per-safe recording policies:\n\n```\nSafe: Production-Servers-Admin\n  Record all sessions: Yes\n\nSafe: Development-Servers\n  Record all sessions: No (optional for non-production)\n\nSafe: Third-Party-Vendor-Access\n  Record all sessions: Yes\n  Enable real-time monitoring: Yes\n  Require dual authorization: Yes\n```\n\n### Step 4: Enable Real-Time Session Monitoring\n\nConfigure live session monitoring for SOC analysts:\n\n```\nPVWA > Monitoring > Privileged Session Monitoring\n\nLive Monitoring Dashboard:\n  - Active Sessions: Shows all current privileged sessions in real-time\n  - Session Details: User, target, duration, risk score\n  - Actions Available:\n    - Watch: View the session in real-time (read-only)\n    - Suspend: Temporarily freeze the session\n    - Terminate: Immediately end the session\n\nConfigure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):\n\nPTA > Configuration > Security Events\n\nRule: High-Risk Command Detected\n  Trigger: Unix command matches pattern\n  Patterns:\n    - rm -rf \u002F\n    - chmod 777\n    - iptables -F\n    - useradd\n    - passwd root\n    - dd if=\u002Fdev\u002F\n    - wget http* | sh\n    - curl * | bash\n    - nc -e \u002Fbin\u002Fsh\n    - python -c 'import socket,subprocess'\n  Action: Alert SOC + Flag session as high-risk\n\nRule: Credential Access Attempt\n  Trigger: Windows process matches\n  Patterns:\n    - mimikatz.exe\n    - procdump.exe targeting lsass\n    - ntdsutil.exe\n    - secretsdump\n  Action: Terminate session + Alert SOC + Lock account\n\nRule: Unusual Session Duration\n  Trigger: Session duration exceeds 4 hours\n  Action: Alert SOC for review\n```\n\n### Step 5: Configure Session Review Workflow\n\nSet up the post-session review process for auditors:\n\n```\nPVWA > Recordings > Search and Review\n\nSearch Filters:\n  - Date range\n  - Target server\n  - User who initiated the session\n  - Safe name\n  - Session risk score (from PTA)\n  - Session duration\n\nReview Workflow:\n  1. Auditor opens recorded session in PVWA HTML5 player\n  2. Video playback with timeline scrubbing\n  3. Keystroke transcript displayed alongside video\n  4. Window title log shows which applications were opened\n  5. Risk events are highlighted on the timeline with markers\n  6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation\n\nFast-Forward Features:\n  - Jump to keystrokes (skip idle time)\n  - Jump to risk events (flagged by PTA)\n  - Text search within keystroke transcript\n  - Filter by window title changes\n```\n\n### Step 6: Open-Source Alternative — Teleport for Session Recording\n\nFor environments without CyberArk, Teleport provides session recording for SSH, RDP, and Kubernetes:\n\n```yaml\n# \u002Fetc\u002Fteleport.yaml - Session recording configuration\nteleport:\n  nodename: teleport-proxy.corp.internal\n  data_dir: \u002Fvar\u002Flib\u002Fteleport\n\nauth_service:\n  enabled: yes\n  session_recording: \"node-sync\"  # Record at the node level, sync to auth server\n\n  # Session recording storage (S3 for production)\n  audit_sessions_uri: \"s3:\u002F\u002Fteleport-session-recordings\u002Fsessions?region=us-east-1\"\n\n  # Enhanced session recording (captures commands even in nested shells)\n  enhanced_recording:\n    enabled: true\n    command_events: true\n    network_events: true\n    disk_events: true\n\nssh_service:\n  enabled: yes\n  enhanced_recording:\n    enabled: true\n\nproxy_service:\n  enabled: yes\n  web_listen_addr: 0.0.0.0:443\n```\n\nQuery recorded sessions with `tsh`:\n\n```bash\n# List recorded sessions\ntsh recordings ls --from=2026-03-15 --to=2026-03-19\n\n# Play back a specific session\ntsh play \u003Csession-id>\n\n# Export session events as JSON (for SIEM ingestion)\ntsh recordings export \u003Csession-id> --format=json > session_events.json\n\n# Search for sessions containing specific commands\ntsh recordings ls --query='command == \"rm -rf\"'\n```\n\n### Step 7: Forward Session Metadata to SIEM\n\nSend session events and alerts to the SIEM for correlation with other security data:\n\n```\nCyberArk PTA Integration:\n  SIEM Connector: Syslog (CEF format) or REST API\n  Target: Splunk, Microsoft Sentinel, QRadar, or Elastic\n\nEvents Forwarded:\n  - Session start\u002Fstop with user, target, and duration\n  - High-risk command detection alerts\n  - Session termination events\n  - Failed connection attempts\n  - Dual-authorization requests and approvals\u002Fdenials\n\nSyslog Configuration (PTA):\n  PTA > Configuration > SIEM Integration\n  Protocol: TCP + TLS\n  Destination: siem.corp.internal:6514\n  Format: CEF (Common Event Format)\n\nExample CEF Event:\n  CEF:0|CyberArk|PTA|12.6|HighRiskCommand|High Risk Command Detected|8|\n  src=10.1.5.42 suser=admin1 dhost=prod-db-01 cs1=rm -rf \u002Fvar\u002Flog\n  cs2=PSM-SSH cs3=Production-Servers-Admin\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PSM (Privileged Session Manager)** | CyberArk component that acts as a proxy\u002Fjump server, recording all privileged sessions in video and text format |\n| **PSMP (PSM for SSH Proxy)** | Linux-based PSM proxy specifically for SSH, SCP, and SFTP sessions |\n| **Connection Component** | CyberArk configuration that defines how PSM launches client applications (RDP, SSH, SSMS) to connect to target systems |\n| **Privileged Threat Analytics (PTA)** | CyberArk module that applies behavioral analytics and risk scoring to recorded sessions to detect anomalous activity |\n| **Dual Authorization** | Security control requiring two authorized users to approve a privileged session before it is established |\n| **Session Isolation** | Architecture principle where administrators never directly connect to targets; all access is proxied through the PAM system |\n| **Keystroke Transcript** | Text log of all keystrokes typed during a recorded session, searchable for audit and forensic purposes |\n| **Vaulting** | Storing privileged credentials in an encrypted digital vault so they are never exposed to the end user |\n\n## Verification\n\n- [ ] All privileged access to production targets routes through PSM (direct RDP\u002FSSH is blocked by firewall)\n- [ ] Session recordings are being stored in the Vault with encryption and tamper protection\n- [ ] Keystroke transcripts are captured and searchable for SSH and RDP sessions\n- [ ] PTA rules trigger alerts for high-risk commands (test with a benign trigger pattern)\n- [ ] Real-time monitoring dashboard shows active sessions with correct metadata\n- [ ] Session recordings play back correctly in PVWA HTML5 player with timeline and transcript\n- [ ] Storage estimates are validated and retention policies match compliance requirements\n- [ ] Dual authorization is enforced for vendor and high-risk target access\n- [ ] Session metadata and alerts are forwarding to SIEM and correlating correctly\n- [ ] Auditors can search, review, and annotate sessions through the PVWA interface\n- [ ] Terminated sessions leave a complete recording up to the point of termination\n","# Implementing Privileged Session Monitoring\n\n## When to Use\n\n- Deploying or configuring session recording for all privileged access to critical servers and databases\n- Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring\n- Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions\n- Implementing real-time alerting for high-risk commands executed during privileged sessions\n- Establishing a forensic audit trail of all administrative actions on production infrastructure\n\n**Do not use** for monitoring standard user sessions or endpoint activity; use EDR\u002FUBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.\n\n## Prerequisites\n\n- CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured\n- CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows\u002FLinux jump server\n- Network architecture where all privileged access is routed through the PSM proxy (no direct RDP\u002FSSH to targets)\n- PVWA (Password Vault Web Access) deployed and accessible for session review\n- Active Directory integration for authenticating PAM users\n- Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)\n- Alternatively for open-source: Teleport, Apache Guacamole with session recording, or `script`\u002F`ttyrec` for Linux\n\n## Workflow\n\n### Step 1: Architecture — Route All Privileged Access Through PSM\n\nEnsure no direct privileged access bypasses the recording proxy:\n\n```\nArchitecture Overview:\n\n  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server\n       │                                     │                     │\n       │         Credentials never           │   Session is        │\n       │         exposed to admin            │   recorded and      │\n       │                                     │   stored in Vault   │\n       └── MFA + AD Auth ──────────────────> │                     │\n                                              └── RDP\u002FSSH proxy ──>│\n\nNetwork Controls:\n- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks\n- Firewall: ALLOW RDP\u002FSSH to target servers ONLY from PSM server IPs\n- Firewall: ALLOW PVWA access (443) from admin user networks\n- PSM server: Hardened, no internet access, local admin access restricted\n```\n\n### Step 2: Configure PSM Connection Components\n\nDefine how PSM connects to target systems. In the PVWA administration console:\n\n```\nPVWA > Administration > Configuration > Connection Components\n\nFor Windows RDP targets:\n  Connection Component: PSM-RDP\n  Protocol: RDP\n  Client Application: mstsc.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI (video) + Keystrokes (text)\n    Record Windows Titles: Yes\n\nFor Linux SSH targets:\n  Connection Component: PSM-SSH\n  Protocol: SSH\n  Client Application: PSM-SecureCRT or PSM-Putty\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI + Text commands\n    Record Unix Commands: Yes\n\nFor Database targets (SQL Server Management Studio):\n  Connection Component: PSM-SSMS\n  Protocol: Custom\n  Client Application: SSMS.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Record SQL Queries: Yes (via keystroke logging)\n```\n\n### Step 3: Configure Session Recording Policies\n\nDefine recording rules based on risk level and compliance requirements:\n\n```\nPVWA > Administration > Platform Management > [Platform] > Session Management\n\nSession Recording Settings:\n  Enable Session Recording: Yes\n  Recording Type: Record and Save (not just Monitor)\n\n  Keystroke Logging:\n    Enable Transcript: Yes\n    Enable Window Events: Yes\n\n  Storage:\n    Recordings Storage Location: Vault (encrypted, tamper-proof)\n    Retention Period: 90 days (adjust per compliance requirement)\n\n    PCI-DSS:  Retain for 1 year, available for 3 months\n    SOX:      Retain for 7 years\n    HIPAA:    Retain for 6 years\n\n  Compression:\n    Enable Recording Compression: Yes\n    Compression Level: Medium (balance storage vs. quality)\n```\n\nFor granular control, configure per-safe recording policies:\n\n```\nSafe: Production-Servers-Admin\n  Record all sessions: Yes\n\nSafe: Development-Servers\n  Record all sessions: No (optional for non-production)\n\nSafe: Third-Party-Vendor-Access\n  Record all sessions: Yes\n  Enable real-time monitoring: Yes\n  Require dual authorization: Yes\n```\n\n### Step 4: Enable Real-Time Session Monitoring\n\nConfigure live session monitoring for SOC analysts:\n\n```\nPVWA > Monitoring > Privileged Session Monitoring\n\nLive Monitoring Dashboard:\n  - Active Sessions: Shows all current privileged sessions in real-time\n  - Session Details: User, target, duration, risk score\n  - Actions Available:\n    - Watch: View the session in real-time (read-only)\n    - Suspend: Temporarily freeze the session\n    - Terminate: Immediately end the session\n\nConfigure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):\n\nPTA > Configuration > Security Events\n\nRule: High-Risk Command Detected\n  Trigger: Unix command matches pattern\n  Patterns:\n    - rm -rf \u002F\n    - chmod 777\n    - iptables -F\n    - useradd\n    - passwd root\n    - dd if=\u002Fdev\u002F\n    - wget http* | sh\n    - curl * | bash\n    - nc -e \u002Fbin\u002Fsh\n    - python -c 'import socket,subprocess'\n  Action: Alert SOC + Flag session as high-risk\n\nRule: Credential Access Attempt\n  Trigger: Windows process matches\n  Patterns:\n    - mimikatz.exe\n    - procdump.exe targeting lsass\n    - ntdsutil.exe\n    - secretsdump\n  Action: Terminate session + Alert SOC + Lock account\n\nRule: Unusual Session Duration\n  Trigger: Session duration exceeds 4 hours\n  Action: Alert SOC for review\n```\n\n### Step 5: Configure Session Review Workflow\n\nSet up the post-session review process for auditors:\n\n```\nPVWA > Recordings > Search and Review\n\nSearch Filters:\n  - Date range\n  - Target server\n  - User who initiated the session\n  - Safe name\n  - Session risk score (from PTA)\n  - Session duration\n\nReview Workflow:\n  1. Auditor opens recorded session in PVWA HTML5 player\n  2. Video playback with timeline scrubbing\n  3. Keystroke transcript displayed alongside video\n  4. Window title log shows which applications were opened\n  5. Risk events are highlighted on the timeline with markers\n  6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation\n\nFast-Forward Features:\n  - Jump to keystrokes (skip idle time)\n  - Jump to risk events (flagged by PTA)\n  - Text search within keystroke transcript\n  - Filter by window title changes\n```\n\n### Step 6: Open-Source Alternative — Teleport for Session Recording\n\nFor environments without CyberArk, Teleport provides session recording for SSH, RDP, and Kubernetes:\n\n```yaml\n# \u002Fetc\u002Fteleport.yaml - Session recording configuration\nteleport:\n  nodename: teleport-proxy.corp.internal\n  data_dir: \u002Fvar\u002Flib\u002Fteleport\n\nauth_service:\n  enabled: yes\n  session_recording: \"node-sync\"  # Record at the node level, sync to auth server\n\n  # Session recording storage (S3 for production)\n  audit_sessions_uri: \"s3:\u002F\u002Fteleport-session-recordings\u002Fsessions?region=us-east-1\"\n\n  # Enhanced session recording (captures commands even in nested shells)\n  enhanced_recording:\n    enabled: true\n    command_events: true\n    network_events: true\n    disk_events: true\n\nssh_service:\n  enabled: yes\n  enhanced_recording:\n    enabled: true\n\nproxy_service:\n  enabled: yes\n  web_listen_addr: 0.0.0.0:443\n```\n\nQuery recorded sessions with `tsh`:\n\n```bash\n# List recorded sessions\ntsh recordings ls --from=2026-03-15 --to=2026-03-19\n\n# Play back a specific session\ntsh play \u003Csession-id>\n\n# Export session events as JSON (for SIEM ingestion)\ntsh recordings export \u003Csession-id> --format=json > session_events.json\n\n# Search for sessions containing specific commands\ntsh recordings ls --query='command == \"rm -rf\"'\n```\n\n### Step 7: Forward Session Metadata to SIEM\n\nSend session events and alerts to the SIEM for correlation with other security data:\n\n```\nCyberArk PTA Integration:\n  SIEM Connector: Syslog (CEF format) or REST API\n  Target: Splunk, Microsoft Sentinel, QRadar, or Elastic\n\nEvents Forwarded:\n  - Session start\u002Fstop with user, target, and duration\n  - High-risk command detection alerts\n  - Session termination events\n  - Failed connection attempts\n  - Dual-authorization requests and approvals\u002Fdenials\n\nSyslog Configuration (PTA):\n  PTA > Configuration > SIEM Integration\n  Protocol: TCP + TLS\n  Destination: siem.corp.internal:6514\n  Format: CEF (Common Event Format)\n\nExample CEF Event:\n  CEF:0|CyberArk|PTA|12.6|HighRiskCommand|High Risk Command Detected|8|\n  src=10.1.5.42 suser=admin1 dhost=prod-db-01 cs1=rm -rf \u002Fvar\u002Flog\n  cs2=PSM-SSH cs3=Production-Servers-Admin\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PSM (Privileged Session Manager)** | CyberArk component that acts as a proxy\u002Fjump server, recording all privileged sessions in video and text format |\n| **PSMP (PSM for SSH Proxy)** | Linux-based PSM proxy specifically for SSH, SCP, and SFTP sessions |\n| **Connection Component** | CyberArk configuration that defines how PSM launches client applications (RDP, SSH, SSMS) to connect to target systems |\n| **Privileged Threat Analytics (PTA)** | CyberArk module that applies behavioral analytics and risk scoring to recorded sessions to detect anomalous activity |\n| **Dual Authorization** | Security control requiring two authorized users to approve a privileged session before it is established |\n| **Session Isolation** | Architecture principle where administrators never directly connect to targets; all access is proxied through the PAM system |\n| **Keystroke Transcript** | Text log of all keystrokes typed during a recorded session, searchable for audit and forensic purposes |\n| **Vaulting** | Storing privileged credentials in an encrypted digital vault so they are never exposed to the end user |\n\n## Verification\n\n- [ ] All privileged access to production targets routes through PSM (direct RDP\u002FSSH is blocked by firewall)\n- [ ] Session recordings are being stored in the Vault with encryption and tamper protection\n- [ ] Keystroke transcripts are captured and searchable for SSH and RDP sessions\n- [ ] PTA rules trigger alerts for high-risk commands (test with a benign trigger pattern)\n- [ ] Real-time monitoring dashboard shows active sessions with correct metadata\n- [ ] Session recordings play back correctly in PVWA HTML5 player with timeline and transcript\n- [ ] Storage estimates are validated and retention policies match compliance requirements\n- [ ] Dual authorization is enforced for vendor and high-risk target access\n- [ ] Session metadata and alerts are forwarding to SIEM and correlating correctly\n- [ ] Auditors can search, review, and annotate sessions through the PVWA interface\n- [ ] Terminated sessions leave a complete recording up to the point of termination\n",{"name":5,"tags":54,"author":57,"domain":40,"license":15,"version":58,"nist_csf":59,"subdomain":64,"description":65,"mitre_attack":66},[43,55,41,32,39,38,56],"CyberArk","compliance","mahipal","1.0.0",[60,61,62,63],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management","Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.\n",[67,68,69,70],"T1078","T1110","T1556","T1098","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-privileged-session-monitoring","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-privileged-session-monitoring",{"tool":85,"command":86},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-privileged-session-monitoring",{"tool":88,"command":89},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-privileged-session-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-privileged-session-monitoring\u002FSKILL.md",true,[93,98,104],{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-privileged-session-monitoring\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",2069,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-privileged-session-monitoring\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",8215,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-privileged-session-monitoring\u002Fscripts\u002Fagent.py",[111,150,159,168,190,215],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":130,"publishedAt":49},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[118,121,124,127],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":128,"categoryName":129,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员",[113,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":151,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":158,"publishedAt":49},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[154,155,156,157],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":26,"taxonomyTypeDesc":27},[113,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":160,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":49},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[163,164,165,166],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":26,"taxonomyTypeDesc":27},[113,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":49},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[175,176,177,178,179,180,181,182,183,184,185,186,187,188,189],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":49},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,201,202,203,37,204,205,206,207,142,143,208,209,210,211,212,213,214],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":231,"publishedAt":49},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":229,"categoryName":230,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[232,233,234,235,236,237,238,239,139,35,142,143,144,240,241,242,243,244,189,245],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]