Session monitor app

You can use a plugin to activate session monitoring based on the requester, privileged account, or system, and override policy settings. The input into the plugin can include the:

If enabled, the plugin is called when a user checks out privileged access or a product administrator accesses a password directly. This applies only to disclosure methods that support session monitoring. The output of the plugin contains session monitoring settings that override managed system policy settings.

You enable this plugin by typing the name of the program or script in the SMON OPTIONS PLUGIN field on the Manage the system > Modules > Session monitor page.

Some data is not input by default. You must manually enable specific registry settings to allow the plugin to receive this information.

There is a sample plugin script, plugin-smon-options.psl, located in the samples\ directory. You can copy the script to the \<instance>\plugin\ directory and modify it to suit your environment.

# KVGROUP-V1.0
  "" "" = {
    "ead_computer_attributes" "" = {
      "mv_attributes" "" = {
        "<attribute key>" = "<attribute value>" # 0 or more
      } # if plugin_smon_options_found_comp_mv_attrs is set
      "sv_attributes" "" = {
        "<attribute key>" = "<attribute value>" # 0 or more
      } # if plugin_smon_options_found_comp_attrs registry entry is set
        # See Subsection 31.5.1.
    }
    "groups" "" = {
       "<targetid>" = "<groupid>"
    } # if plugin_smon_options_groups registry entry is set
    "managedaccount" "" = {
      "accountid" = "<Managed Account>"
      "msp" = "<Managed System Policy>"
      "resourceid" = "<Managed System>"
    }
    "plugin" "" = {
      "accessdisclosure" = "<ActiveX control name>"
    }
    "request" "" = {
      "requestID" = "<Request ID>" # if applicable
    }
    "smonvars" "" = {
      "<smon variable name>" = "<value>" # 1 or more
    }
    "viewer" "user" = {
      "id" = "<Profile ID>"
      "attribute" "<Profile attribute key>" = {
        "value" "" = {
          "value" = "<Profile value>" # 0 or more
        }
      } # if plugin_smon_options_profile_attrs registry entry is set
    }
  } 

"" "" = {
    "retval" = "<#>" # 0 on success; Otherwise, failure
    "<smon variable name>" = "<value>" # Optional; 0 or more
         } 

The session monitoring batch processing utility, smonprocessmeta, runs periodically while a session monitoring session is active to process harvested data and insert the data into the database in a series of batch operations. The smonsavemeta program creates session data packages when requested.

The Session monitor app uses a powerful search engine to search recorded UI, clipboard, and keystroke data. You control the following options for the search engine in the Manage the system > Modules > Session monitor menu:

These settings define what is considered a ’word’ and loaded into the database. The settings are used in the following order:

If these settings above are changed, only new sessions will be affected. Existing loaded words must be used to search for matching sessions.

These settings are also applied to the Session matching contents field on the Search all recorded data page.

The following are examples of how the settings would be applied:

Bravura Security Fabric runs the smonavi or another video generation program to create video files for recorded session packages. Screenshots are aggregated into hour-long video segments.

The following Manage the system > Modules > Session monitor options control video creation:

smonavi.exe -r %fps% -i %pattern%_*.png -f %path% -c %codec%

The default command defined by the SMON VIDEO CREATE COMMAND LINE is:

smonavi.exe -r %fps% -i %pattern%_*.png -f %path% -c %codec%

Where:

Alternatively you can specify a third party program; for example:

ffmpeg.exe -r %fps% -i %pattern%_%09d.png %path%

If you specify another program, you can match the argument variables with the utilities expected command line. For example, the following two programs require different input values for the images to be used to make the video:

See also

smonavi usage information

The following Session monitor app events can launch interface programs and can be accessed from Manage the system > Maintenance > System variables or Manage the system > Modules> Session monitor: