9.3 Session Recording, Storage in Recordings Safes & Vault Retention

9.3 Session Recording, Storage in Recordings Safes & Vault Retention

Quick Answer: Privileged Session Manager (PSM) records all proxied administrative activities using a dual-stream architecture: searchable text metadata (keystrokes, window titles, executed commands, SQL statements) and compressed graphical video (differential screen frames and vector graphics). During an active session, recordings are buffered locally on the PSM host in C:\Program Files (x86)\CyberArk\PSM\Recordings. Once the session ends, the recording is finalized and uploaded asynchronously over TCP port 1858 into dedicated Vault Safes (such as PSMRecordings or PSMRecordingsSafe_<PSMServerName>). In the Vault, recordings are protected by AES-256 object-level encryption, tamper-resistant immutability, and configurable Safe retention policies, with long-term compliance archiving supported via PAReplicate.

---

The Dual Architecture: Metadata Indexing vs. Visual Capture

A critical design achievement of CyberArk PSM is the separation of session recording into two distinct, synchronized streams:

1. Searchable Text & Keystroke Metadata

• What is Captured: Keystrokes typed by the user, active window titles, process launches, SQL queries (in database connection components), clipboard copy/paste events, and shell commands.
• Storage Mechanism: Stored as searchable text metadata and audit events in the Vault database and recordings Safes.
• Operational Purpose: Allows security officers to search PVWA for specific activity (e.g., searching for DROP TABLE, net user /add, or regedit) and immediately jump to the exact second in the video recording where that action occurred. It also provides telemetry streamed to Privileged Threat Analytics (PTA) for real-time anomaly detection.

2. Differential Vector & Frame Screen Capture

• What is Captured: Full visual capture of the remote desktop or terminal interface.
• Proprietary Compression Engine: PSM does not record continuous high-framerate raster video (such as a 30 FPS MP4 stream), which would generate hundreds of megabytes per session. Instead, PSM captures screen differentials, graphical update bounding boxes, and vector drawing commands compressed using CyberArk's recording codecs.
• Storage Efficiency: When an administrator leaves their session idle, PSM records zero frames. Under normal administrative workloads, graphical recording consumes only 1 to 5 MB per hour of active session, achieving extreme storage efficiency without degrading playback fidelity.

---

The Session Recording Lifecycle: Endpoint to Vault

The recording workflow is engineered to guarantee audit trail integrity even during network degradation between the PSM server and the Digital Vault:

1. Real-Time Capture & In-Flight Buffering: When an administrator launches a session, the PSM core service spawns the connection component along with the recording monitor process (CAPSMRcp.exe or equivalent recorder). The recorder captures user interface events, window focus changes, and keystroke buffers directly from the isolated session.
2. Local Disk Spooling on PSM: Recording chunks are spooled locally on the PSM host's NTFS filesystem at C:\Program Files (x86)\CyberArk\PSM\Recordings. Active subfolders contain .rec (video/vector data), .log (audit text events), and .idx (timeline synchronization) files. Local buffering ensures that transient network interruptions between PSM and the Vault never cause dropped frames or dropped sessions.
3. Session Finalization & Checksumming: When the user disconnects, logs off, or is terminated, the recording service closes file handles, generates a cryptographic hash/checksum of the recording bundle to ensure tamper-evidence, and marks files for upload.
4. Asynchronous Upload to Vault (TCP 1858): The PSM Uploader service initiates an authenticated session to the Digital Vault over TCP port 1858 using PSMAppUser. The finalized recording files are uploaded into the target recordings Safe. Once the Vault confirms that the object is committed to disk, the upload transaction completes.
5. Local Cache Pruning (RecordingCleanDays): To prevent the PSM local disk from filling up, the PSM maintenance engine evaluates the local Recordings directory. The parameter RecordingCleanDays (configured in basic_psminf.ini or platform settings, defaulting to 2–7 days) determines how long uploaded recording files are retained locally before deletion.

---

Vault Recordings Safes Architecture & Cryptographic Protection

Recordings stored in the Digital Vault are managed within specialized Vault Safes designed for high-capacity binary storage and strict regulatory governance:

• Consolidated Safe (PSMRecordings): In smaller environments, all PSM servers upload session recordings into a single default Safe named PSMRecordings.
• Per-Server Safes (PSMRecordingsSafe_<PSMServerName>): In enterprise environments with multiple PSM servers, recordings are segregated into dedicated Safes named after each PSM host (e.g., PSMRecordingsSafe_PSM01). This avoids Safe-level file count bottlenecks, isolates Safe locks, and optimizes database performance.
• Envelope Encryption: Every recording uploaded to the Vault is encrypted with a unique symmetric AES-256 object key. The object key is encrypted with the Safe Key, which is encrypted by the Vault's Server Key. Individual recordings cannot be decrypted or inspected without authenticated Vault engine arbitration.
• WORM Immutability: Recordings Safes enforce Write Once, Read Many (WORM) compliance. Vault administrators and PSM service accounts do not possess permission to edit or truncate recording objects. The Vault database rejects any API request attempting to modify an archived recording.
• Separation of Duties: PSMAppUser holds Add file/object, List files, and Write file/object permissions, but never Delete or Modify. Members of the Auditors group hold Retrieve file/object and List files to view recordings in PVWA.

---

Retention Policies, Compliance & Storage Management

Session recordings represent the fastest-growing consumer of storage capacity within the Digital Vault:

• Compliance Mandates: PCI-DSS Requirement 10.7 mandates retaining audit logs for at least 1 year, with 90 days immediately available online. Sarbanes-Oxley (SOX) Section 404 often requires retaining records for 5 to 7 years.
• Vault Safe Retention vs. Object Versioning: For recordings Safes, object versioning is set to 0 because recordings are static, immutable single-instance files. Retention is governed by the Safe property Retention (days) (e.g., 180 days). The Vault's internal purge process automatically deletes recording objects exceeding this retention window.
• Preventing Storage Exhaustion: If the Vault NTFS storage volume drops below emergency thresholds (e.g., less than 1–2 GB free), the PrivateArk Server engine will automatically halt the Vault service to prevent database corruption.
• Long-Term Cold Archiving with PAReplicate: Organizations deploy the CyberArk PAReplicate utility on an external backup server to copy recording Safes to cold enterprise storage tiers (SAN, NAS, AWS S3 Glacier, Azure Archive). Once replicated externally, the online Vault retention window can be safely set to 90 or 180 days.

---

Session Recording Profiles & Storage Impact