TRM_RMTSESS_START
1 min
Terminator session start. Whenever a new session begins on a machine running Keystrike Terminator, a TRM_RMTSESS_START activity is recorded.
For example, as someone logs into a user account via Remote Desktop to a Windows server.
{
"time": "2023-11-21T15:11:08Z",
"activity": "TRM_RMTSESS_START",
"user_id": "12301e1b-3122-56af-88ad-caea2df60e42",
"uname : "acme\\johndoe",
"trm_id": "0c074926-402a-593b-9cc6-9e9467eeaec6",
"trm_type": "RDS",
"trm_uname": "acme\\johndoe_admin",
"trm_status": "ACTIVE",
"os_user_id": "S-1-5-21-3623811015-3361044348-30300820-1013",
"node_ver": "1.0.0",
"dev_id": "173e340e-9c31-4756-941b-a909412c095e",
"dev_name": "SRV-DAM3-01",
"mode": "enforce",
"user_map": "DYNAMIC",
"remote_method ": "rdp",
"remote_ip": "123.456.58.01",
"trm_conn_id": "1715967581_2-plnDh2ZzWd-1",
"trm_rmtsess_id": "1744196758-pk5UxPlMBA"
}
Mode (mode)
- audit - the terminator was in audit mode only.
- enforce - the terminator was in enforcement mode.
- bypass - terminator bypass policy was enabled for this account. No session is created and no alerts sent in that case.