For auditing purposes, all RDP and SSH sessions in Password Safe can be recorded and accessible for viewing from the Sessions > Completed Sessions grid. Session recording is available for regular sessions, ISA sessions, and Admin sessions. The following users can view recorded sessions:
- Users with the Auditor role
- Users with the Recorded Session Reviewer role
- Users with the ISA role
To access and review completed sessions in Password Safe, follow these steps:
- From the left navigation, click Menu, and then click Completed Sessions under Password Safe.
- Use the Protocol and Filter By dropdowns above the grid to filter the list to assist with locating the desired session. Once you have located the session you wish to view, click the vertical ellipsis for it, and then select View Session .
- Alternatively, you can select View Details and then click the View Session link from the Session Details pane.
If a session recording has been archived, the View Session option is not available. If available, select the Restore Session option to restore the recording. You can also restore the archived session from the session's details by selecting View Details and then clicking the Restore link.
- Once the session displays, click Play to review the recording. You can hover over any part of the video progress bar to reveal the time stamp and click anywhere on the bar to select an instance in the recorded session. Use the control buttons below the recording to pause and restart the recording.
Keystrokes that occurred within the session, such as the user opening a window, accessing an application, or clicking an option, are stored as events and listed in the Events pane to the left of the recorded session. You can click specific listed events or click the Prev and Next buttons below the recording to skip to those events within the recording.
To take a screenshot of a session frame and export it as a JPEG file, click the Snapshot button. The file exports with a resolution of 1024 × 768. The JPEG file is automatically saved to the default download location specified in your browser settings.
- Add comments and check Mark as Reviewed for auditing purposes.
- The number of audits is displayed as a link above the session recording. Click the link to view who viewed the session and when, as well as to see their comments.
Use Keystroke Search
To find sessions in either Active Sessions or Completed Sessions, enter a word or phrase in the Quick filter field. The list of sessions is automatically filtered based on what is entered in the field.
To search for global keystrokes, select Keystroke from the Filter by dropdown list, and then enter a word or phrase in the Keystroke field.
Restore Archived Session
In Password Safe Cloud, sessions older than six months are automatically archived. This prevents data storage issues for Cloud users. However, archived sessions can easily be restored so they can be replayed. To restore an archived session:
- Navigate to Password Safe > Sessions > Completed Sessions.
- Locate the archived session, and then click the vertical ellipsis to the right of the session.
- Select Restore Session. The restore takes place in the background.
Once the session has been restored, follow the steps in the View Recorded Sessions section to view the restored session.