[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HMA910WDJFE0CCDH75C458":3,"skill-same:01M6HMA910WDJFE0CCDH75C458":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6HMA910WDJFE0CCDH75C458","implementing-privileged-session-monitoring",null,"Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-privileged-session-monitoring\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"implementing","monitoring","session","implementing privileged session monitoring","session-recording","recording","open-source","Session Manager","access","open","session-monitoring","cybersecurity","privileged-session","PSM","cyberark","PAM","t1098","t1078","compliance","pr","2026-11-10 10:12:30",false,"---\nname: implementing-privileged-session-monitoring\ndescription: Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke...\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- PAM\n- CyberArk\n- PSM\n- privileged-session\n- session-recording\n- session-monitoring\n- compliance\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\ncategory: implementing-privileged-session-monitoring\n---\n# Implementing-Privileged-Session-Monitoring\n\n## Overview\nImplements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.\n\n\n\n# Implementing Privileged Session Monitoring\n\n## When to Use\n\n- Deploying or configuring session recording for all privileged access to critical servers and databases\n- Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring\n- Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions\n- Implementing real-time alerting for high-risk commands executed during privileged sessions\n- Establishing a forensic audit trail of all administrative actions on production infrastructure\n\n**Do not use** for monitoring standard user sessions or endpoint activity; use EDR\u002FUBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.\n\n## Prerequisites\n\n- CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured\n- CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows\u002FLinux jump server\n- Network architecture where all privileged access is routed through the PSM proxy (no direct RDP\u002FSSH to targets)\n- PVWA (Password Vault Web Access) deployed and accessible for session review\n- Active Directory integration for authenticating PAM users\n- Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)\n- Alternatively for open-source: Teleport, Apache Guacamole with session recording, or `script`\u002F`ttyrec` for Linux\n\n## Workflow\n\n### Step 1: Architecture — Route All Privileged Access Through PSM\n\nEnsure no direct privileged access bypasses the recording proxy:\n\n```\nArchitecture Overview:\n\n  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server\n       │                                     │                     │\n       │         Credentials never           │   Session is        │\n       │         exposed to admin            │   recorded and      │\n       │                                     │   stored in Vault   │\n       └── MFA + AD Auth ──────────────────> │                     │\n                                              └── RDP\u002FSSH proxy ──>│\n\nNetwork Controls:\n- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks\n- Firewall: ALLOW RDP\u002FSSH to target servers ONLY from PSM server IPs\n- Firewall: ALLOW PVWA access (443) from admin user networks\n- PSM server: Hardened, no internet access, local admin access restricted\n```\n\n### Step 2: Configure PSM Connection Components\n\nDefine how PSM connects to target systems. In the PVWA administration console:\n\n```\nPVWA > Administration > Configuration > Connection Components\n\nFor Windows RDP targets:\n  Connection Component: PSM-RDP\n  Protocol: RDP\n  Client Application: mstsc.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI (video) + Keystrokes (text)\n    Record Windows Titles: Yes\n\nFor Linux SSH targets:\n  Connection Component: PSM-SSH\n  Protocol: SSH\n  Client Application: PSM-SecureCRT or PSM-Putty\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI + Text commands\n    Record Unix Commands: Yes\n\nFor Database targets (SQL Server Management Studio):\n  Connection Component: PSM-SSMS\n  Protocol: Custom\n  Client Application: SSMS.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Record SQL Queries: Yes (via keystroke logging)\n```\n\n### Step 3: Configure Session Recording Policies\n\nDefine recording rules based on risk level and compliance requirements:\n\n```\nPVWA > Administration > Platform Management > [Platform] > Session Management\n\nSession Recording Settings:\n  Enable Session Recording: Yes\n  Recording Type: Record and Save (not just Monitor)\n\n  Keystroke Logging:\n    Enable Transcript: Yes\n    Enable Window Events: Yes\n\n  Storage:\n    Recordings Storage Location: Vault (encrypted, tamper-proof)\n    Retention Period: 90 days (adjust per compliance requirement)\n\n    PCI-DSS:  Retain for 1 year, available for 3 months\n    SOX:      Retain for 7 years\n    HIPAA:    Retain for 6 years\n\n  Compression:\n    Enable Recording Compression: Yes\n    Compression Level: Medium (balance storage vs. quality)\n```\n\nFor granular control, configure per-safe recording policies:\n\n```\nSafe: Production-Servers-Admin\n  Record all sessions: Yes\n\nSafe: Development-Servers\n  Record all sessions: No (optional for non-production)\n\nSafe: Third-Party-Vendor-Access\n  Record all sessions: Yes\n  Enable real-time monitoring: Yes\n  Require dual authorization: Yes\n```\n\n### Step 4: Enable Real-Time Session Monitoring\n\nConfigure live session monitoring for SOC analysts:\n\n```\nPVWA > Monitoring > Privileged Session Monitoring\n\nLive Monitoring Dashboard:\n  - Active Sessions: Shows all current privileged sessions in real-time\n  - Session Details: User, target, duration, risk score\n  - Actions Available:\n    - Watch: View the session in real-time (read-only)\n    - Suspend: Temporarily freeze the session\n    - Terminate: Immediately end the session\n\nConfigure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):\n\nPTA > Configuration > Security Events\n\nRule: High-Risk Command Detected\n  Trigger: Unix command matches pattern\n  Patterns:\n    - rm -rf \u002F\n    - chmod 777\n    - iptables -F\n    - useradd\n    - passwd root\n    - dd if=\u002Fdev\u002F\n    - wget http* | sh\n    - curl * | bash\n    - nc -e \u002Fbin\u002Fsh\n    - python -c 'import socket,subprocess'\n  Action: Alert SOC + Flag session as high-risk\n\nRule: Credential Access Attempt\n  Trigger: Windows process matches\n  Patterns:\n    - mimikatz.exe\n    - procdump.exe targeting lsass\n    - ntdsutil.exe\n    - secretsdump\n  Action: Terminate session + Alert SOC + Lock account\n\nRule: Unusual Session Duration\n  Trigger: Session duration exceeds 4 hours\n  Action: Alert SOC for review\n```\n\n### Step 5: Configure Session Review Workflow\n\nSet up the post-session review process for auditors:\n\n```\nPVWA > Recordings > Search and Review\n\nSearch Filters:\n  - Date range\n  - Target server\n  - User who initiated the session\n  - Safe name\n  - Session risk score (from PTA)\n  - Session duration\n\nReview Workflow:\n  1. Auditor opens recorded session in PVWA HTML5 player\n  2. Video playback with timeline scrubbing\n  3. Keystroke transcript displayed alongside video\n  4. Window title log shows which applications were opened\n  5. Risk events are highlighted on the timeline with markers\n  6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation\n\nFast-Forward Features:\n  - Jump to keystrokes (skip idle time)\n  - Jump to risk events (flagged by PTA)\n  - Text search within keystroke transcript\n  - Filter by window title changes\n```\n\n### Step 6: Open-Source Alternative — Teleport for Session Recording\n\nFor environments without CyberArk, Teleport provides session recording for SSH, RDP, and Kubernetes:\n\n```yaml\n# \u002Fetc\u002Fteleport.yaml - Session recording configuration\nteleport:\n  nodename: teleport-proxy.corp.internal\n  data_dir: \u002Fvar\u002Flib\u002Fteleport\n\nauth_service:\n  enabled: yes\n  session_recording: \"node-sync\"  # Record at the node level, sync to auth server\n\n  # Session recording storage (S3 for production)\n  audit_sessions_uri: \"s3:\u002F\u002Fteleport-session-recordings\u002Fsessions?region=us-east-1\"\n\n  # Enhanced session recording (captures commands even in nested shells)\n  enhanced_recording:\n    enabled: true\n    command_events: true\n    network_events: true\n    disk_events: true\n\nssh_service:\n  enabled: yes\n  enhanced_recording:\n    enabled: true\n\nproxy_service:\n  enabled: yes\n  web_listen_addr: 0.0.0.0:443\n```\n\nQuery recorded sessions with `tsh`:\n\n```bash\n# List recorded sessions\ntsh recordings ls --from=2026-03-15 --to=2026-03-19\n\n# Play back a specific session\ntsh play \u003Csession-id>\n\n# Export session events as JSON (for SIEM ingestion)\ntsh recordings export \u003Csession-id> --format=json > session_events.json\n\n# Search for sessions containing specific commands\ntsh recordings ls --query='command == \"rm -rf\"'\n```\n\n### Step 7: Forward Session Metadata to SIEM\n\nSend session events and alerts to the SIEM for correlation with other security data:\n\n```\nCyberArk PTA Integration:\n  SIEM Connector: Syslog (CEF format) or REST API\n  Target: Splunk, Microsoft Sentinel, QRadar, or Elastic\n\nEvents Forwarded:\n  - Session start\u002Fstop with user, target, and duration\n  - High-risk command detection alerts\n  - Session termination events\n  - Failed connection attempts\n  - Dual-authorization requests and approvals\u002Fdenials\n\nSyslog Configuration (PTA):\n  PTA > Configuration > SIEM Integration\n  Protocol: TCP + TLS\n  Destination: siem.corp.internal:6514\n  Format: CEF (Common Event Format)\n\nExample CEF Event:\n  CEF:0|CyberArk|PTA|12.6|HighRiskCommand|High Risk Command Detected|8|\n  src=10.1.5.42 suser=admin1 dhost=prod-db-01 cs1=rm -rf \u002Fvar\u002Flog\n  cs2=PSM-SSH cs3=Production-Servers-Admin\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PSM (Privileged Session Manager)** | CyberArk component that acts as a proxy\u002Fjump server, recording all privileged sessions in video and text format |\n| **PSMP (PSM for SSH Proxy)** | Linux-based PSM proxy specifically for SSH, SCP, and SFTP sessions |\n| **Connection Component** | CyberArk configuration that defines how PSM launches client applications (RDP, SSH, SSMS) to connect to target systems |\n| **Privileged Threat Analytics (PTA)** | CyberArk module that applies behavioral analytics and risk scoring to recorded sessions to detect anomalous activity |\n| **Dual Authorization** | Security control requiring two authorized users to approve a privileged session before it is established |\n| **Session Isolation** | Architecture principle where administrators never directly connect to targets; all access is proxied through the PAM system |\n| **Keystroke Transcript** | Text log of all keystrokes typed during a recorded session, searchable for audit and forensic purposes |\n| **Vaulting** | Storing privileged credentials in an encrypted digital vault so they are never exposed to the end user |\n\n## Verification\n\n- [ ] All privileged access to production targets routes through PSM (direct RDP\u002FSSH is blocked by firewall)\n- [ ] Session recordings are being stored in the Vault with encryption and tamper protection\n- [ ] Keystroke transcripts are captured and searchable for SSH and RDP sessions\n- [ ] PTA rules trigger alerts for high-risk commands (test with a benign trigger pattern)\n- [ ] Real-time monitoring dashboard shows active sessions with correct metadata\n- [ ] Session recordings play back correctly in PVWA HTML5 player with timeline and transcript\n- [ ] Storage estimates are validated and retention policies match compliance requirements\n- [ ] Dual authorization is enforced for vendor and high-risk target access\n- [ ] Session metadata and alerts are forwarding to SIEM and correlating correctly\n- [ ] Auditors can search, review, and annotate sessions through the PVWA interface\n- [ ] Terminated sessions leave a complete recording up to the point of termination\n","# Implementing-Privileged-Session-Monitoring\n\n## Overview\nImplements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.\n\n\n\n# Implementing Privileged Session Monitoring\n\n## When to Use\n\n- Deploying or configuring session recording for all privileged access to critical servers and databases\n- Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring\n- Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions\n- Implementing real-time alerting for high-risk commands executed during privileged sessions\n- Establishing a forensic audit trail of all administrative actions on production infrastructure\n\n**Do not use** for monitoring standard user sessions or endpoint activity; use EDR\u002FUBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions.\n\n## Prerequisites\n\n- CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured\n- CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows\u002FLinux jump server\n- Network architecture where all privileged access is routed through the PSM proxy (no direct RDP\u002FSSH to targets)\n- PVWA (Password Vault Web Access) deployed and accessible for session review\n- Active Directory integration for authenticating PAM users\n- Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH)\n- Alternatively for open-source: Teleport, Apache Guacamole with session recording, or `script`\u002F`ttyrec` for Linux\n\n## Workflow\n\n### Step 1: Architecture — Route All Privileged Access Through PSM\n\nEnsure no direct privileged access bypasses the recording proxy:\n\n```\nArchitecture Overview:\n\n  Admin User ──> PVWA (Web Portal) ──> PSM (Jump Server) ──> Target Server\n       │                                     │                     │\n       │         Credentials never           │   Session is        │\n       │         exposed to admin            │   recorded and      │\n       │                                     │   stored in Vault   │\n       └── MFA + AD Auth ──────────────────> │                     │\n                                              └── RDP\u002FSSH proxy ──>│\n\nNetwork Controls:\n- Firewall: DENY direct RDP (3389) and SSH (22) to target servers from user networks\n- Firewall: ALLOW RDP\u002FSSH to target servers ONLY from PSM server IPs\n- Firewall: ALLOW PVWA access (443) from admin user networks\n- PSM server: Hardened, no internet access, local admin access restricted\n```\n\n### Step 2: Configure PSM Connection Components\n\nDefine how PSM connects to target systems. In the PVWA administration console:\n\n```\nPVWA > Administration > Configuration > Connection Components\n\nFor Windows RDP targets:\n  Connection Component: PSM-RDP\n  Protocol: RDP\n  Client Application: mstsc.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI (video) + Keystrokes (text)\n    Record Windows Titles: Yes\n\nFor Linux SSH targets:\n  Connection Component: PSM-SSH\n  Protocol: SSH\n  Client Application: PSM-SecureCRT or PSM-Putty\n  Recording Settings:\n    Record Sessions: Yes\n    Recording Format: AVI + Text commands\n    Record Unix Commands: Yes\n\nFor Database targets (SQL Server Management Studio):\n  Connection Component: PSM-SSMS\n  Protocol: Custom\n  Client Application: SSMS.exe\n  Recording Settings:\n    Record Sessions: Yes\n    Record SQL Queries: Yes (via keystroke logging)\n```\n\n### Step 3: Configure Session Recording Policies\n\nDefine recording rules based on risk level and compliance requirements:\n\n```\nPVWA > Administration > Platform Management > [Platform] > Session Management\n\nSession Recording Settings:\n  Enable Session Recording: Yes\n  Recording Type: Record and Save (not just Monitor)\n\n  Keystroke Logging:\n    Enable Transcript: Yes\n    Enable Window Events: Yes\n\n  Storage:\n    Recordings Storage Location: Vault (encrypted, tamper-proof)\n    Retention Period: 90 days (adjust per compliance requirement)\n\n    PCI-DSS:  Retain for 1 year, available for 3 months\n    SOX:      Retain for 7 years\n    HIPAA:    Retain for 6 years\n\n  Compression:\n    Enable Recording Compression: Yes\n    Compression Level: Medium (balance storage vs. quality)\n```\n\nFor granular control, configure per-safe recording policies:\n\n```\nSafe: Production-Servers-Admin\n  Record all sessions: Yes\n\nSafe: Development-Servers\n  Record all sessions: No (optional for non-production)\n\nSafe: Third-Party-Vendor-Access\n  Record all sessions: Yes\n  Enable real-time monitoring: Yes\n  Require dual authorization: Yes\n```\n\n### Step 4: Enable Real-Time Session Monitoring\n\nConfigure live session monitoring for SOC analysts:\n\n```\nPVWA > Monitoring > Privileged Session Monitoring\n\nLive Monitoring Dashboard:\n  - Active Sessions: Shows all current privileged sessions in real-time\n  - Session Details: User, target, duration, risk score\n  - Actions Available:\n    - Watch: View the session in real-time (read-only)\n    - Suspend: Temporarily freeze the session\n    - Terminate: Immediately end the session\n\nConfigure monitoring alerts in CyberArk Privileged Threat Analytics (PTA):\n\nPTA > Configuration > Security Events\n\nRule: High-Risk Command Detected\n  Trigger: Unix command matches pattern\n  Patterns:\n    - rm -rf \u002F\n    - chmod 777\n    - iptables -F\n    - useradd\n    - passwd root\n    - dd if=\u002Fdev\u002F\n    - wget http* | sh\n    - curl * | bash\n    - nc -e \u002Fbin\u002Fsh\n    - python -c 'import socket,subprocess'\n  Action: Alert SOC + Flag session as high-risk\n\nRule: Credential Access Attempt\n  Trigger: Windows process matches\n  Patterns:\n    - mimikatz.exe\n    - procdump.exe targeting lsass\n    - ntdsutil.exe\n    - secretsdump\n  Action: Terminate session + Alert SOC + Lock account\n\nRule: Unusual Session Duration\n  Trigger: Session duration exceeds 4 hours\n  Action: Alert SOC for review\n```\n\n### Step 5: Configure Session Review Workflow\n\nSet up the post-session review process for auditors:\n\n```\nPVWA > Recordings > Search and Review\n\nSearch Filters:\n  - Date range\n  - Target server\n  - User who initiated the session\n  - Safe name\n  - Session risk score (from PTA)\n  - Session duration\n\nReview Workflow:\n  1. Auditor opens recorded session in PVWA HTML5 player\n  2. Video playback with timeline scrubbing\n  3. Keystroke transcript displayed alongside video\n  4. Window title log shows which applications were opened\n  5. Risk events are highlighted on the timeline with markers\n  6. Auditor marks session as: Reviewed-OK, Reviewed-Suspicious, or Requires-Investigation\n\nFast-Forward Features:\n  - Jump to keystrokes (skip idle time)\n  - Jump to risk events (flagged by PTA)\n  - Text search within keystroke transcript\n  - Filter by window title changes\n```\n\n### Step 6: Open-Source Alternative — Teleport for Session Recording\n\nFor environments without CyberArk, Teleport provides session recording for SSH, RDP, and Kubernetes:\n\n```yaml\n# \u002Fetc\u002Fteleport.yaml - Session recording configuration\nteleport:\n  nodename: teleport-proxy.corp.internal\n  data_dir: \u002Fvar\u002Flib\u002Fteleport\n\nauth_service:\n  enabled: yes\n  session_recording: \"node-sync\"  # Record at the node level, sync to auth server\n\n  # Session recording storage (S3 for production)\n  audit_sessions_uri: \"s3:\u002F\u002Fteleport-session-recordings\u002Fsessions?region=us-east-1\"\n\n  # Enhanced session recording (captures commands even in nested shells)\n  enhanced_recording:\n    enabled: true\n    command_events: true\n    network_events: true\n    disk_events: true\n\nssh_service:\n  enabled: yes\n  enhanced_recording:\n    enabled: true\n\nproxy_service:\n  enabled: yes\n  web_listen_addr: 0.0.0.0:443\n```\n\nQuery recorded sessions with `tsh`:\n\n```bash\n# List recorded sessions\ntsh recordings ls --from=2026-03-15 --to=2026-03-19\n\n# Play back a specific session\ntsh play \u003Csession-id>\n\n# Export session events as JSON (for SIEM ingestion)\ntsh recordings export \u003Csession-id> --format=json > session_events.json\n\n# Search for sessions containing specific commands\ntsh recordings ls --query='command == \"rm -rf\"'\n```\n\n### Step 7: Forward Session Metadata to SIEM\n\nSend session events and alerts to the SIEM for correlation with other security data:\n\n```\nCyberArk PTA Integration:\n  SIEM Connector: Syslog (CEF format) or REST API\n  Target: Splunk, Microsoft Sentinel, QRadar, or Elastic\n\nEvents Forwarded:\n  - Session start\u002Fstop with user, target, and duration\n  - High-risk command detection alerts\n  - Session termination events\n  - Failed connection attempts\n  - Dual-authorization requests and approvals\u002Fdenials\n\nSyslog Configuration (PTA):\n  PTA > Configuration > SIEM Integration\n  Protocol: TCP + TLS\n  Destination: siem.corp.internal:6514\n  Format: CEF (Common Event Format)\n\nExample CEF Event:\n  CEF:0|CyberArk|PTA|12.6|HighRiskCommand|High Risk Command Detected|8|\n  src=10.1.5.42 suser=admin1 dhost=prod-db-01 cs1=rm -rf \u002Fvar\u002Flog\n  cs2=PSM-SSH cs3=Production-Servers-Admin\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PSM (Privileged Session Manager)** | CyberArk component that acts as a proxy\u002Fjump server, recording all privileged sessions in video and text format |\n| **PSMP (PSM for SSH Proxy)** | Linux-based PSM proxy specifically for SSH, SCP, and SFTP sessions |\n| **Connection Component** | CyberArk configuration that defines how PSM launches client applications (RDP, SSH, SSMS) to connect to target systems |\n| **Privileged Threat Analytics (PTA)** | CyberArk module that applies behavioral analytics and risk scoring to recorded sessions to detect anomalous activity |\n| **Dual Authorization** | Security control requiring two authorized users to approve a privileged session before it is established |\n| **Session Isolation** | Architecture principle where administrators never directly connect to targets; all access is proxied through the PAM system |\n| **Keystroke Transcript** | Text log of all keystrokes typed during a recorded session, searchable for audit and forensic purposes |\n| **Vaulting** | Storing privileged credentials in an encrypted digital vault so they are never exposed to the end user |\n\n## Verification\n\n- [ ] All privileged access to production targets routes through PSM (direct RDP\u002FSSH is blocked by firewall)\n- [ ] Session recordings are being stored in the Vault with encryption and tamper protection\n- [ ] Keystroke transcripts are captured and searchable for SSH and RDP sessions\n- [ ] PTA rules trigger alerts for high-risk commands (test with a benign trigger pattern)\n- [ ] Real-time monitoring dashboard shows active sessions with correct metadata\n- [ ] Session recordings play back correctly in PVWA HTML5 player with timeline and transcript\n- [ ] Storage estimates are validated and retention policies match compliance requirements\n- [ ] Dual authorization is enforced for vendor and high-risk target access\n- [ ] Session metadata and alerts are forwarding to SIEM and correlating correctly\n- [ ] Auditors can search, review, and annotate sessions through the PVWA interface\n- [ ] Terminated sessions leave a complete recording up to the point of termination\n",{"name":5,"tags":44,"author":46,"domain":30,"license":15,"version":47,"category":5,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54},[34,45,32,31,23,29,37],"CyberArk","mahipal","1.0.0",[49,50,51,52],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[55,56,57,58],"T1078","T1110","T1556","T1098","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-privileged-session-monitoring",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-privileged-session-monitoring",{"tool":73,"command":74},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-privileged-session-monitoring",{"tool":76,"command":77},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-privileged-session-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-privileged-session-monitoring\u002FSKILL.md",true,[81,86,92],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-privileged-session-monitoring\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",2069,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-privileged-session-monitoring\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fagent.py","SCRIPT","脚本",8215,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-privileged-session-monitoring\u002Fscripts\u002Fagent.py",[99,129,155,178,194,215],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":110,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[105],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[111,112,113,114,115,116,30,117,118,119,120,121,122,36,123,124,125,126,127,128],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[136,137,138,139,140,30,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[162,163,126,30,164,165,166,36,123,167,168,169,170,171,172,173,174,175,176,177],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[162,185,186,163,126,140,30,187,165,120,188,189,36,123,190,168,150,191,192,193],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[162,201,202,203,204,205,30,206,207,208,165,209,36,210,211,212,171,213,126,214],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":221,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[222,223,224,225,30,20,226,227,228,229,230,210,231,232,213,233,214,234,235,236],"infrastructure","tracking threat actor infrastructure","tracking","threat","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]