Documentation
Event filtering
Boundary events can be emitted in several formats, including cloudevents and hclog, and can be encoded as text and JSON.
Use case
SSH session recording and audit logs improve security posture, facilitate analysis of user activity, and help meet compliance.
Challenge
As the number of cyberattacks increases, so do the requirements to protect organizations from both internal and external threats. In order to meet compliance, many organizations are required not only to log user event activity but also to record detailed actions performed by each user. Audit logs and recordings are needed to facilitate the analysis of suspicious or malicious behavior.
Solution
Boundary improves security with SSH session recording, which can deter users from questionable or malicious activity. It allows administrators to record every SSH session, which can immediately be played back to detail the commands and actions executed by each user. In the event of a threat incident, session recording facilitates analysis to help identify the origin, scope, and impact, resulting in an expedited remediation plan. In addition, Boundary provides storage policies to manage the lifecycle of the stored recordings, allowing administrators to set retention and auto-deletion dates to meet regulatory and compliance requirements (like HIPAA,SOC 2, etc) while also helping to reduce storage costs.
Boundary also includes audit logging, which allows administrators to log user access to infrastructure resources and Boundary components.
Together, SSH session recording and audit logs help organizations meet compliance and regulatory requirements that are common in many organizations.
Documentation
Boundary events can be emitted in several formats, including cloudevents and hclog, and can be encoded as text and JSON.
Documentation
Create a secure, tamper-proof system of record around the activities that transpire when users access sensitive data and systems.
Documentation
A system of record of user access and actions can help you meet compliance and allow you to monitor and react to security incidents and malicious activity.