Skip to content

Auditing Sessions: Report

All remote access sessions, whether initiated through a web browser or a native client, are captured and made available for review via the Sessions Report. This report is accessible to users with the appropriate permissions and provides detailed insights into session activity.

This article outlines the types of information and actions available from the Sessions Report, depending on the actions taken during a remote access session.

Global Session Report

Sessions Report

The Sessions Report can be accessed in two primary ways:

  • From an Asset: To view all sessions associated with a specific asset, navigate to the asset’s View page, then go to Reports > Sessions.
  • Global View: To view all sessions across the environment, regardless of asset, use the global navigation: Reports > Sessions from the left-hand menu. Requires the Administrator or Auditor site role.

Regardless of access path, the information displayed in each session entry remains consistent.

Report Columns

The Sessions Report includes the following columns. Sessions are sorted by the Created column by default, either in ascending or descending order:

  • Asset: The name of the asset from the Asset Database where the session occurred.
  • User: The user who initiated the session.
  • Created: Timestamp indicating when the session was started.
  • Updated: Timestamp of the last recorded activity within the session.
  • Completed: Timestamp marking when the session ended.
  • State: The current state of the session:
    • Active: Session is currently in progress.
    • Completed: Session has ended.
  • Session ID: A unique identifier assigned to the session for reference purposes.
  • Channels: Communication protocols used during the session. Possible values include:
    • RDP: Web RDP Session
    • SSH: Web SSH Session
    • VNC: Web VNC Session
    • Telnet: Web Telnet Session
    • RDPP: Native client RDP Session
    • SSHP:Shell: Native client SSH Shell or CLI Shell Session
    • SSHP:Exec: Native client SSH Exec Session
    • SSHP:SFTP: Native client SSH SFTP Session
    • SSHP:SCP: Native client SSH SCP Session
    • SSHP:Tunnel: Native client SSH Tunnel Session
  • Gateway: Hostname or IP address and port of the gateway that brokered the session.
  • Account: The account used on the remote endpoint to establish the session.

Report Actions

The following actions may be available for sessions, based on their state and if they were recorded or not:

  • Terminate: Available only for Active sessions. Forcefully ends the selected session.
  • Play (tab): Available only for Completed and Recorded sessions. Opens the video recording of the session in a new browser tab.
  • Play (window): Available only for Completed and Recorded sessions. Opens the video recording of the session in a new browser window.
  • Session Events: Available only for Recorded sessions. Opens the Session Events report, which includes a timeline of captured actions such as keystrokes, file transfers, and clipboard activity.
  • Video Manager: Available only for Completed and Recorded sessions. Opens the Video Manager dialog to convert and download video recorded sessions for viewing outside of the browser.

Sessions Report Actions