Privileged Sessions, Monitoring & Auditing

Monitor real-time privileged sessions, enforce command blacklists, execute live disconnections, and review tamper-proof keystroke recordings.

Section: Operations Format: Asciinema v2

Live Session Monitoring

Security administrators can view live privileged sessions through the Sessions → Active Sessions dashboard. The console displays:

Operator identity and source IP address.
Target asset hostname and target system user account.
Connection duration and active terminal size.
Live terminal mirror button allowing supervisor shadowing in real time.

Session Termination

If an administrator observes suspicious activity or unauthorized commands during a live session, they can immediately terminate the session with a single click in the UI or via API:

# Terminate active session via AllSafeX CLI
docker compose exec core python manage.py terminate_session --session-id=a8f9-42b1

Command Blacklisting & Alerts

AllSafeX intercepts every keystroke before passing it to the target shell. Administrators can define command filtering rules:

Pattern	Action	Notification
`rm -rf /`	Block Immediately	Critical Security Alert to Slack / Email
`mkfs.*`	Block Immediately	Critical Security Alert to Email
`shutdown -h now`	Require Confirmation	Supervisor Approval Required

Raw Terminal Recording

All interactive terminal sessions are written to disk as standardized asciinema JSON files. These recordings capture exact timing, terminal escape codes, and window resize events.

Recordings can be played back in the web browser console or inspected locally:

# Play back a recording directly in your local terminal
asciinema play /opt/allsafex/data/recordings/2026-10-15/session-a8f9.cast

Audit Log Retention

Audit records and session playback files are preserved in accordance with enterprise compliance policies. Automated log rotation can archive recordings to Amazon S3, MinIO, or an NFS share.