SESS_START
1 min
Session start. Indicates that the given user started a secure session from his Keystrike client to a terminator.
{
"time": "2023-11-21T15:11:08Z",
"activity": "SESS_START",
"user_id": "12301e1b-3122-56af-88ad-caea2df60e42",
"uname : "acme\\johndoe",
"sess_id": "q4xmB4BJJ6",
"trm_id": "0c074926-402a-593b-9cc6-9e9467eeaec6",
"trm_type": "RDS",
"trm_uname": "acme\\johndoe_admin",
"cli_id": "68eaeb11-477e-53cf-a352-abcded985362",
"mode": "enforce",
"user_map": "DYNAMIC",
"remote_method ": "rdp",
"remote_ip": "123.456.58.01",
"cli_conn_id": "1715944317_1-zorMqlbqCu-1",
"trm_conn_id": "1715967581_2-plnDh2ZzWd-1",
"trm_rmtsess_id": "1744196758-pk5UxPlMBA"
}
Mode (mode)
- audit - the terminator was in audit mode only for this session, not in enforcement mode.
- enforce - the terminator was in enforcement mode for this session.