implementing-privileged-session-monitoring

# Implementing Privileged Session Monitoring ## When to Use - Deploying or configuring session recording for all privileged access to critical servers and databases - Meeting compliance requirements (PCI-DSS 10.2, SOX, HIPAA, ISO 27001) that mandate privileged activity monitoring - Investigating an incident where an administrator or third-party vendor may have performed unauthorized actions - Implementing real-time alerting for high-risk commands executed during privileged sessions - Establishing a forensic audit trail of all administrative actions on production infrastructure **Do not use** for monitoring standard user sessions or endpoint activity; use EDR/UBA solutions for general user behavior monitoring. Privileged session monitoring focuses specifically on elevated-access sessions. ## Prerequisites - CyberArk PAM Self-Hosted or Privilege Cloud deployment with Digital Vault configured - CyberArk Privileged Session Manager (PSM) or PSM for SSH (PSMP) installed on a hardened Windows/Linux jump server - Network architecture where all privileged access is routed through the PSM proxy (no direct RDP/SSH to targets) - PVWA (Password Vault Web Access) deployed and accessible for session review - Active Directory integration for authenticating PAM users - Sufficient storage for session recordings (estimate: 50-250 KB per minute for RDP, 5-20 KB per minute for SSH) - Alternatively for open-source: Teleport, Apache Guacamole with session recording, or `script`/`ttyrec` for Li...