Method and device for searching and playing back historical privileged session

Abstract

The invention discloses a method and device for searching and playing back a historical privileged session. The method comprises the following steps that: A) a privileged account security management system receives a search condition, wherein the search condition is a time range, keyword information or an event ID; B) historical privileged sessions are searched according to the search conditions to obtain historical privileged sessions meeting the search conditions; C) a corresponding event occurrence point is quickly positioned according to the keyword information or the command information;and D) full playback is performed on the historical privileged session or only playing back a certain specific event. The method for searching and playing back the historical privileged session has the following beneficial effects: the historical privileged session can be positioned and played back quickly and accurately according to the search condition, so that managers of enterprises and organizations do not need to spend too much time and energy in searching and playing back the historical privileged session, and the IT cost of the enterprises and the organizations is saved, and auditing management of the privileged session is better realized.

Description

technical field [0001] The invention relates to the field of security management of privileged accounts, in particular to a method and device for searching and replaying historical privileged sessions. Background technique [0002] Privileged accounts refer to accounts with high risks (such as administrator accounts that can start and stop devices) or high value (such as application accounts that can read business-sensitive data). Privileged accounts can provide almost unlimited access rights. Due to various reasons, internal employees, partners, and third-party users need to access privileged accounts securely. It becomes imperative to track the operations performed by users using their privileged access. However, when a security incident occurs, there is no efficient way to immediately locate the event occurrence point for the historical privileged session. Usually, the audit video of the entire historical privileged session is viewed. Auditing of privileged sessions beco...

AI Technical Summary

Problems solved by technology

Auditing of privileged sessions becomes difficult if the privileged session lasts too long

Images