5.7 Command Risk

Using Command Risk, you can set a value representing the relative risk of a command when using the following:

  • pcksh or cpcksh clients

  • RDP sessions

  • DB monitoring sessions with the session auditing option

  • All Databases

In the Keystroke Report, different colors represent the commands with various risk levels.

To set the risk levels, perform the following steps:

  1. Click Settings > Server Settings > Command Risk on the Administration Console.

  2. Click Add.

  3. Specify the following details:

    Field

    Description

    Risk

    Set a value for the risk level. You can specify any value between 0 to 9 where:

    • 0 indicates no risk

    • 1 - 3 indicate a low risk

    • 4 - 6 indicates a medium risk

    • 7 - 9 indicates a high risk

    Command

    Specify the command for which you want to set a risk value or a regular expression. You can use wildcard symbols

    Working Directory

    Specify the name of the working directory to assess the risk level based on the directory, where the command is executed.

    Run User

    To assess the risk level based on the user executing the command. Specify a specific user.

    Submit User

    Specify the name of the user you want to disconnect if that user executes a specific command.

    Ensure to specify the name in capital letters for the following users:

    • Windows users for Direct RDP

    • LDAP users who are part of the authentication domain

    Run Host

    To assess the risk level based on the host where the command is being executed, specify a designated host.

    Auto Disconnect

    Turn on the toggle to disconnect the session for specified user when the specified command is executed.

    Block User

    Turn on the toggle to refrain the specified user from starting the session again after it was disconnected.

    Block Command

    Turn on the toggle to prevent any user from executing the specified command.

    NOTE:Currently, the Block Command option is supported for Databases and SSH relay.

  4. Click Tick icon to save the entry.

  5. Click Update.

Use the arrow buttons to change the order in which the commands are listed.

Select the entry, then click Delete icon to remove a command risk entry.