TRM_CONN
1 min
Terminator connection. Each time a Keystrike terminator session connects to Dispatch, a TRM_CONN activity is recorded.
{
"time": "2023-11-21T15:11:08Z",
"activity": "TRM_CONN",
"user_id": "12301e1b-3122-56af-88ad-caea2df60e42",
"uname : "acme\\johndoe",
"trm_id": "0c074926-402a-593b-9cc6-9e9467eeaec6",
"trm_type": "RDS",
"trm_uname": "acme\\johndoe_admin",
"trm_status": "ACTIVE",
"os_user_id": "S-1-5-21-3623811015-3361044348-30300820-1013",
"node_ver": "1.0.0",
"dev_id": "173e340e-9c31-4756-941b-a909412c095e",
"dev_name": "SRV-DAM3-01",
"os_name": "Microsoft Windows Server 2022 Standard",
"mode": "enforce",
"ip": "123.456.58.01",
"user_map": "DYNAMIC",
"trm_conn_id": "1715967581_2-plnDh2ZzWd-1"
}
Mode (mode)
- audit - the terminator was in audit mode only.
- enforce - the terminator was in enforcement mode.
- bypass - terminator bypass policy was enabled for this account. No session is created and no alerts sent in that case.