Live Session Analysis Policy [BETA]

The Live Session Analysis policy type acts on the findings reported by the AI analysis agents while a session is still running. The policy fires when a single agent reports the configured number of findings at or above the selected severity, and can then notify the administrator, pause or terminate the session, or block the user.

Note

This policy type requires AI Live Session Monitoring [BETA] to be enabled and configured. The findings themselves are produced by the analysis agents; this policy only reacts to them.

Like the feature it depends on, this policy type is available in Fudo Enterprise 6.2 as a beta version. Once live session monitoring leaves the beta stage, it will be delivered as a separate module, and the availability of this policy type will depend on your license.

Important

The policy acts on the verdict of an AI model. Before enabling the Pause session, Terminate session or Block user action, verify on non-critical safes how the selected agents judge the activity typical of your environment.

Policy Configuration

  1. Select Management > Policies.

  2. Click Add Policy.

  3. Provide a name for the policy.

  4. Select the Severity. The severity parameter value is included in email notifications and in the Events log.

  5. In the Policy type section, select Live Session Analysis.

  6. Set Minimum finding severity - the policy reacts to findings at this level or higher.

  7. Set Minimum number of findings - how many such findings a single agent must report during one session.

  8. Configure Policy Behaviour - select the actions to take:

    • - Send email - send a notification with the finding to administrators

    • - Send push - send an alert to the Fudo Officer mobile app

    • - SNMP Trap - send an SNMP notification

    • - Pause session - pause the session for review

    • - Terminate session - end the session immediately

    • - Block user - prevent further access by the user

  9. Click Save.

  10. Assign the policy to a safe used to establish the monitored connections.

  • Select Management > Safes.

  • Edit the selected safe by clicking on its name.

  • Go to the Policies tab and select the Live Session Analysis policy created in the previous step.

  • Click Save.

Note

The Minimum finding severity field offers medium and high only. Findings of a lower level are not stored, so a lower threshold could never be reached.

Warning

Findings are counted per agent - the findings of different agents are never added together. A policy requiring three findings is satisfied when one agent reports three of them, not when three agents report one each. Agents have different remits, so their findings are not comparable.

Note

A policy that has already fired stays quiet until a more serious finding appears in the same session. Only then are the actions executed again, so a single session does not generate a stream of identical alerts.

Findings that arrive after the session has ended can no longer pause or terminate it. In that case Fudo Enterprise performs the actions that remain meaningful - the notification and blocking the user.

Notifications

Firing of the policy can be reported with the Live Session Analysis notification, which is sent when a live analysis policy fires on an agent’s findings during a session. The message contains the finding itself: the agent, the severity and the summary of what was detected.

Related Topics