In Powerbroker for Windows there is a feature to capture user session data for certain rules. We need this functionality in the Privilege Management product as well. In Powerbroker you can select the option on a rule to “Enable Session Monitoring”.
We use this functionally to better understand what users are using less targeted rules for. It helps us to understand the workflow the user is performing and what rules to tailor for a least privilege model. This is also user for auditing usage of elevated rights where the process audit events are not clear as to what is happening on the system.
This is already setup in BI and the client just need to forward the data so we can view the session information there like we can in Powerbroker today.