Skip to content

Joining Active Sessions

The 12Port PAM platform supports the ability for users with Asset Manager or higher permission on the asset, to join an active Web session in real time. This feature is accessible as an action on individual sessions from the site-level or asset-level session reports.

Why Session "Join"?

The session join capability supports several practical and strategic use cases, including:

  • Live session monitoring: Joining a session provides real-time insight into user actions.
  • Administrator training: Use Participate Mode to co-navigate or observe tasks for training and onboarding new administrators.
  • RFP and compliance requirements: Satisfies common requirements for:
    • Live session intervention, including pause (session termination with reconnect option), control (via Participate Mode), and terminate (access request revocation).
  • Real-time threat response: Enables asset owners or security operators to respond immediately to suspicious behavior. After receiving alerts or red flags from Session Intelligence, they can:
    • Join the session
    • Evaluate the situation
    • Interact or terminate access as necessary

Session Join Modes

When joining a session, two modes are available:

  • Monitor Mode: Provides watch-only access to the live session. The joiner can view all user activity but cannot interact with the session.
  • Participate Mode: Grants full control, including keyboard and mouse access, allowing the joiner to actively interact with the session.

How to Join an Active Session

For users with Asset Manager or higher (or Site Administrator role), they can Join an active Web session using the following procedure:

  1. From the Sessions Report (Site or Asset level) locate the Active session to be joined and use its Actions > Join Session option. Session Join Action
  2. In the Join Session Session Launcher, select the desired parameters to join this active session:
    • Window Type: Open the Joined session in a new browser Tab or Window.
    • Intent: Join in Monitor or Participate mode.
    • Transport: Use the web protocol HTTP or Websocket. Session Join Launcher
  3. Click the Access button to join the session.

Once joined, a visual indicator is displayed in the joiner's session toolbar to reflect the active join state and the mode in use.

Monitor Mode indicator: Session Join - Monitor Mode Indicator

Participate Mode indicator: Session Join - Participant Mode Indicator

When the Joiner is finished, they may use their in-session Toolbar option to Disconnect or simply close their browser Tab or Window.

Events Report Logging

Joined Sessions will generate an entry for both Join and Leave actions in the Events Report and the Session Events Report.

Event Log Entry (Join Session):
Level: Information
Category: Operation
Event: Join Session
Message: user=<loginName (DisplayName) / userDirectory>, intent=<Monitor or Participate> Join Session Event Report Log Entry

Event Log Entry (Leave Session):
Level: Information
Category: Operation
Event: Leave Session
Message: user=<loginName (DisplayName) / userDirectory>, intent=<Monitor or Participate> Leave Session Event Report Log Entry


Session Event Log Entry (Join Session):
Level: Information
Category: Operation
Event: Session Event
Message: preview=Participant: <loginName (DisplayName) / userDirectory>, Intent: <Monitor or Participate>, name, type=SessionJoin, user=<loginName (DisplayName) / userDirectory> Join Session "Session Event" Event Report Log Entry

Session Event Log Entry (Leave Session):
Level: Information
Category: Operation
Event: Session Event
Message: preview=Participant: <loginName (DisplayName) / userDirectory>, Intent: <Monitor or Participate>, name, type=SessionLeave, user=<loginName (DisplayName) / userDirectory> Leave Session "Session Event" Event Report Log Entry