AI Session Summary Policy

The AI Session Summary policy type monitors AI-generated session summaries for risk indicators and triggers actions when specified risk thresholds are detected. This policy works in conjunction with the AI Session Summary feature (configured separately) to provide automated response to suspicious activities identified in session summaries.

Note

This policy type requires the AI Session Summary feature to be enabled and configured. The summaries themselves are generated independently; this policy only monitors them for risk conditions. See AI Session Summary [BETA] for summary generation configuration.

Policy Configuration

Follow these steps to configure an AI Session Summary policy:

  1. Select Management > Policies.

  2. Click Add Policy.

  3. Provide a name for the policy.

  4. Select the Severity (low, medium, high, critical). The severity parameter value is included in email notifications and in the Events log.

  5. In the Policy type section, select AI Session Summary.

../../_images/6-0-ai-session-summary-policy-create.png

  1. Configure the risk detection thresholds:

    • Risk Level Threshold - Minimum risk level to trigger the policy (low, medium, high, critical)

    • Keyword Detection - Specific keywords or patterns to monitor in summaries

    • Activity Categories - Types of activities to flag (unauthorized access, data exfiltration, privilege escalation, etc.)

    • Anomaly Score - Threshold for anomaly detection based on AI analysis

  2. Configure trigger conditions:

    • Match Type - ANY (trigger on any condition) or ALL (require all conditions)

    • Time Window - Period for evaluating conditions (real-time, last 5 minutes, last hour)

    • Occurrence Count - Number of detections required to trigger

  3. Configure Policy Behaviour - select actions to take when risk conditions are detected:

    • - Send email - Send notification with risk details to administrators

    • - Send push - Send immediate alert to Fudo Officer mobile app

    • - SNMP Trap - Send SNMP notification

    • - Pause session - Temporarily pause the session for review

    • - Terminate session - Immediately end the session

    • - Block user - Prevent further access by the user

  1. Click Save.

  2. After defining a policy, assign it to a safe that is used to establish connections to servers.

  • Select Management > Safes.

  • Edit the selected safe by clicking on its name.

  • Go to the Policies tab and select the AI Session Summary policy created in the previous step.

  • Click Save.

../../_images/5-5-policy-safe-add.png

How It Works

The AI Session Summary policy operates through the following workflow:

  1. Summary Generation - AI generates session summaries based on session activities (configured separately)

  2. Risk Analysis - The AI analyzes summaries for risk indicators and anomalies

  3. Policy Evaluation - This policy evaluates the risk analysis against configured thresholds

  4. Action Triggering - When thresholds are exceeded, configured actions are executed

  5. Alerting - Administrators receive notifications with risk details and recommended actions


Related Topics