AI Live Session Monitoring [BETA]

Fudo Enterprise can analyze an SSH session while it is still running. A transcript of the session is passed to one or more analysis agents backed by an external AI model, and each agent reports its findings with a severity. The findings appear in the Fudo Enterprise interface while the session is in progress, and a policy can act on them - up to pausing or terminating the session, or blocking the user.

Note

Live session monitoring is available in Fudo Enterprise 6.2 as a beta version. You are encouraged to explore this functionality and share your feedback, but review its findings before relying on them for automated response.

Once the feature leaves the beta stage, it will be delivered as a separate module, and its availability will depend on your license.

Important

Live session monitoring sends session activity outside Fudo Enterprise for processing, to the AI model you connect. Unlike AI Behavioral Analysis, which uses an internal model and sends nothing outside Fudo Enterprise, this feature transmits the content of monitored sessions continuously, for as long as the session lasts.

The model may belong to an external provider such as Anthropic or Open AI, in which case session content leaves your infrastructure, or it may be a model you host yourself, in which case it does not. Analysis with an external provider may incur cost on that provider’s side.

Note

  • Live session monitoring is currently available for SSH sessions only.

  • The feature is disabled by default. A new installation analyzes nothing until an administrator enables it.

How it works

  1. Fudo Enterprise produces a running text transcript of the monitored SSH session.

  2. Every analysis agent enabled for the session’s safe receives the transcript, together with the context described for the safe, the server, the account and the user.

  3. Each agent returns findings, each with a severity: LOW RISK, MEDIUM RISK or HIGH RISK. A fragment that could not be analyzed at all is marked UNKNOWN - this means the AI provider was unavailable or kept returning errors, so that part of the session was not assessed.

  4. Findings are shown in the sessions list and in the session player as they arrive.

  5. If a Live Session Analysis policy is assigned to the safe, reaching its threshold triggers the configured actions.

A session is analyzed only when all of the following hold:

  • live session monitoring was enabled at the moment the session started,

  • the safe used for the connection has at least one analysis agent selected,

  • each of those agents has a provider assigned and that provider works.

Note

The switch is evaluated when a session starts. Enabling live session monitoring does not pick up sessions that are already running, and disabling it does not interrupt an analysis in progress - such a session is analyzed to its end.

Configuring an AI provider

A provider defines the AI model the agents run on.

  1. Select Settings > Artificial Intelligence > Live Session Monitoring.

../../_images/6-2-ai-live-session-monitoring.png

  1. In the Providers section, click Add provider.

  2. Enter the Name of the provider.

  3. Select the Provider kind: Anthropic, Open AI or Custom. Select Custom for a self-hosted model.

  4. Enter the URL of the endpoint. For Anthropic and Open AI the field may be left empty - the default endpoint of the selected provider kind is then used. For `Custom` the address is required, because Fudo Enterprise cannot know which endpoint a self-hosted model exposes.

  5. Enter the API key used to authenticate against the provider.

  6. Enter the Model name.

../../_images/6-2-ai-live-provider-add.png

  1. Click Test Connection to verify the configuration.

  2. Click Save.

Note

Once saved, the API key is not displayed again. The form shows the message A key is stored. Enter a new value to replace it. - enter a new key only when you want to change it.

Configuring an analysis agent

An agent is a prompt that defines what to look for in a session. Several agents can watch the same session, each with its own remit.

Note

Fudo Enterprise ships three built-in templates: SSH security, Privilege escalation and Destructive commands. Built-in templates cannot be edited and have no provider assigned, so they never run on their own. Use them as a starting point for your own agents.

  1. Select Settings > Artificial Intelligence > Live Session Monitoring.

  2. In the Agents section, click the name of a built-in template and then click Copy to create an editable copy, or click Add agent to define an agent from scratch.

../../_images/6-2-ai-live-agent-builtin.png

  1. Enter the Name and the Description of the agent.

  2. In the System prompt field, describe what the agent looks for when analyzing a live session. The prompt can be up to 4000 characters long.

  3. In the Provider section, select the provider the agent runs on.

  4. Click Save.

Note

A copy of a built-in template is created under the name <template name> (copy). Change it to something meaningful before saving.

Selecting the monitored safes

Sessions are analyzed per safe. An agent watches only the sessions established through the safes it is assigned to.

  1. Select Management > Safes and edit the selected safe by clicking on its name.

  2. In the Live Session Monitoring section, select the Enable live session monitoring option.

  3. Click Save. For a newly created safe the agent list becomes available only after the safe is saved.

  4. Edit the safe again and select the analysis agents that are to watch sessions in this safe.

  5. Click Save.

Warning

If no agent is selected, sessions in the safe are not analyzed, even when live session monitoring is enabled globally and for the safe.

Describing the context

The AI evaluates a session against the context it is given. Without it, routine administrative work is easily reported as a risk. The AI analysis context field is available in four places, each under the Live Session Monitoring heading:

  • on a safe - what is normal for connections established through this safe,

  • on a server - what the server is used for, for example that it is a build machine,

  • on an account - what the account is normally used for,

  • on a user - the user’s role, for example that the user is an administrator for whom destructive operations are expected.

Note

Describe what is normal rather than what is forbidden. The more accurate the context, the fewer legitimate activities are reported as risks.

Enabling live session monitoring

Once at least one provider and one agent are configured and assigned to a safe, turn the feature on.

  1. Select Settings > Artificial Intelligence > Live Session Monitoring.

  2. Click the Live session monitoring switch.

  3. Confirm the operation in the Enable live session monitoring? window.

Reviewing the findings

Findings are available while the session is running and after it ends.

  • The sessions list has an Analysis column and a side panel titled AI live session monitoring, listing the findings of every agent.

  • The session player shows the risk level of the session and marks the moments the findings refer to. Use Play from this moment to jump straight to the activity a finding describes. This is also where findings are judged.

  • Findings can be filtered by severity and by agent.

  • A session with no findings is presented as NO RISK DETECTED; a session still being analyzed is presented as ANALYSIS IN PROGRESS.

Note

Every report carries the note that it was generated by artificial intelligence and that critical information should be verified independently.

Judging a finding

The AI does not learn from its own findings on its own. It is the operator who decides whether a finding was right, and only findings judged by a person are used to improve later analyses.

Findings are judged in the session player, where each one is marked at the moment of the session it refers to.

  1. Select Sessions and open the selected session in the player.

  2. For the selected finding, click Risk to confirm it as a real risk, or Not a risk to mark it as a false positive.

  3. Optionally click Add a reason and describe the decision.

Note

Findings judged by an operator, together with the reasons given for them, are passed to the AI alongside the context described for the safe, the server, the account and the user. They therefore serve as material from which the AI learns what is normal on that particular server and for that particular user.

Clicking the same judgment again retracts it together with its reason.

Required privileges

  • The ai-read privilege is required to manage analysis agents and to select them on a safe. Without it, the safe form informs that the privilege is missing.

  • The analysis panel of a session requires the session-read privilege. Details of the AI infrastructure - the provider, the model and the token counts - are visible only with the ai-read privilege.

Related topics: