10.1 Live Session Monitoring, Shadowing & Active Termination
Key Takeaways
- Live session shadowing leverages Remote Desktop Services (RDS) shadowing protocol on the PSM server to mirror active administrative sessions in real time without creating a secondary connection to the target system.
- Auditors require Safe-level 'Monitor Sessions' permission to view or shadow live sessions and 'Terminate Sessions' permission to sever active sessions and execute interventions.
- Active intervention capabilities allow security personnel to transmit real-time warning dialogs directly onto the operator's display or execute an immediate session termination that kills child processes and severs the target connection.
- PSM indexes keystrokes, executed processes, Windows titles, and SQL statements in real time into the Vault, enabling keyword searches and direct timeline jump-points during video playback.
10.1 Live Session Monitoring, Shadowing & Active Termination
Quick Answer: Live Session Monitoring and Shadowing in CyberArk PAM allows security auditors to view active administrative sessions in real time via the PVWA Monitoring interface. Built on native Remote Desktop Services (RDS) shadowing, an auditor connects directly to the hosting PSM proxy server—not the target endpoint—ensuring zero disruption, zero target agent overhead, and total session visibility. Authorized auditors holding the Monitor Sessions and Terminate Sessions Safe permissions can actively intervene by dispatching real-time warning messages onto the operator's screen or terminating the session instantly, immediately killing target processes and severing the network connection.
Architecture of Live Session Monitoring & Shadowing
CyberArk Privileged Session Manager (PSM) isolates end users from direct access to critical infrastructure by routing privileged workflows through dedicated jump servers. Beyond recording sessions for historical compliance, PSM incorporates real-time session monitoring and shadowing, giving security personnel the ability to oversee live administrative actions as they occur.
When an administrative user launches a privileged session via Password Vault Web Access (PVWA) or PSM for SSH (PSMP), the PSM server creates an isolated session environment. The live shadowing architecture operates through the following mechanisms:
- Proxy-Centric Connection Tap: The auditor establishes a connection to the PSM proxy server rather than creating a secondary or duplicate administrative connection to the target asset. The target host remains completely unaware of the auditor's presence.
- RDS Shadowing Integration: On Windows-based PSM servers, live monitoring utilizes Microsoft Remote Desktop Services (RDS) session shadowing protocol (
mstsc /shadow). The auditor connects through PVWA, which communicates with the PSM service to attach an RDP shadowing channel to the active session ID. - HTML5 Gateway Streaming: When the auditor accesses PVWA using a modern web browser without a local RDP client, the CyberArk HTML5 Gateway translates the shadowed RDS screen updates into an encrypted WebSocket canvas stream, rendering live video directly inside the browser.
- Non-Intrusive Observation: By default, shadowing operates in view-only mode. The auditor observes keyboard input, cursor movement, window rendering, and application launches in real time without interfering with the operator's workflow or introducing perceptible latency.
Safe-Level Permissions & Role Requirements for Monitoring
Access to live session monitoring is strictly governed through a combination of Safe-level access control lists (ACLs) and Vault user authorizations:
Monitor Sessions: This specific Safe permission grants users the authority to view and shadow active sessions established with accounts stored in the Safe. Without this right, active sessions associated with the Safe remain hidden from the user's PVWA Monitoring view.Terminate Sessions: This Safe permission allows an auditor to actively sever a live connection. An auditor possessing onlyMonitor Sessionscan watch the session but cannot disconnect the user or send intervention messages.List Accounts&Retrieve Accounts: Auditors must possessList Accountsto view account objects and their active sessions within the target Safe. FullRetrieve Accountsis typically withheld from auditors to prevent them from reading or checking out raw underlying passwords.- Vault Role Assignments: Administrators typically assign compliance officers and SOC analysts to the built-in Auditors group or a customized PAM Auditors role. Membership in these groups confers global read-only audit reporting rights while relying on Safe-level grants for live shadowing.
- PVWA Interface Authorizations: In PVWA, the user account must have the Audit and Monitoring feature enabled within its user profile, allowing access to the Monitoring workspace tab.
Active Intervention: Operator Messaging & Session Termination
When an auditor observes suspicious, non-compliant, or potentially malicious behavior during a live session, CyberArk PAM provides active intervention capabilities:
- Real-Time Warning Messaging: Auditors can transmit an immediate textual notification directly into the active session. On graphical RDP sessions, PSM displays a high-priority message modal on the operator's desktop (for example, warning the user that executing unapproved batch scripts violates corporate policy). In SSH terminal sessions via PSMP, the warning is injected directly into the standard error/output stream.
- Immediate Session Termination: If an operator ignores warnings or executes dangerous operations (such as attempting privilege escalation, modifying firewall rules, or accessing unauthorized database tables), the auditor can click Terminate.
- Process Tree Teardown: PSM issues process termination signals to all child processes spawned within the session sandbox, severs the target connection (RDP, SSH, SQL, or custom client), and closes the client connection. The target account is immediately logged off the destination endpoint.
- Immutable Audit Logging: The moment a session is terminated by an auditor, PSM and the Digital Vault record a high-severity audit record capturing the auditor's identity, timestamp, target account, and optional reason entered during the termination prompt.
Real-Time Keystroke Logging & Activity Indexing
PSM does not simply capture a flat video recording; it operates an inline text inspection and activity indexing engine:
- Keystroke Capture Engine: In graphical sessions, PSM injects low-level keyboard hooks within the isolated user session to record every keystroke typed into command prompts, run dialogs, and terminal emulators. In PSM for SSH (PSMP), the
psmpsrvproxy daemon intercepts all terminal stream characters directly. - Process and Window Title Tracking: PSM continuously polls the operating system desktop manager, capturing every window title switch (such as switching from File Explorer to Registry Editor) and process creation event.
- Universal Connector & SQL Interception: When monitoring database management tools (such as Toad, SQL*Plus, or SQL Server Management Studio), specialized PSM universal connectors intercept database queries at the client driver or socket layer, recording discrete SQL transactions.
- Vault Indexing Pipeline: Textual audit events are buffered in real time and transmitted over TCP port 1858 to the Digital Vault, where they are indexed directly into the
PSMRecordingsSafe as searchable metadata properties linked to the session recording.
Search, Video Playback & Timeline Navigation
The indexed activity pipeline transforms historical audit investigations from tedious manual video reviews into rapid, query-driven workflows:
- Activity-Based Searching: In the PVWA Monitoring workspace, auditors execute granular searches using keyword queries (such as searching for
DROP TABLE,net localgroup administrators,/etc/shadow, orregedit.exe). - Synchronized Timeline Markers: When an auditor opens a session recording in the PVWA Web Player (an HTML5-based video player), the player displays an interactive timeline. Every recorded keystroke, command, and window change appears as a clickable marker along the scrubber bar.
- Instant Incident Jumping: Clicking on a specific query or command marker jumps the video playback instantly to the exact timestamp of execution, enabling forensic investigators to review the visual context surrounding a security event within seconds.
Comparative Analysis: Monitoring, Shadowing, and Audit Modalities
| Feature / Modality | Live Session Shadowing | Post-Session Video Playback | Searchable Keystroke Audit |
|---|---|---|---|
| Operational Timing | Real-time during active session | Retrospective (after session ends or in chunks) | Near real-time and post-session |
| User Disruption | Zero disruption (view-only) | Zero disruption | Zero disruption |
| Target Impact | None; taps into PSM jump server | None; reads from Vault recording safe | None; captured at PSM proxy |
| Required Permissions | Monitor Sessions (+ Terminate Sessions to sever) | Audit Users or Safe access to PSMRecordings | Audit Users or Safe audit view |
| Primary Use Case | SOC high-risk intervention & live oversight | Forensic proof, compliance evidence, dispute resolution | Rapid keyword searching & bulk event correlation |
Which Safe-level permission is specifically required for an auditor to forcefully disconnect an active administrative session exhibiting unauthorized behavior?
How does the CyberArk PSM live session shadowing architecture connect an auditor to an active administrative session without disrupting the primary user?
An auditor investigating a potential security incident in PVWA needs to locate the exact moment an administrator executed a high-risk database query. Which feature of the PSM recording architecture enables jumping directly to the query execution in the video recording?