Logging within JEA sessions
When using JEA, logging is of course possible, and you also should implement it and regularly review audit logs to make sure your JEA configuration is not abused in an unforeseen way.
We already covered logging extensively in Chapter 4, Detection – Auditing and Monitoring, therefore here’s only a little summary of what’s important for logging when it comes to JEA.
Over-the-shoulder transcription
Always configure over-the-shoulder transcription for users running commands via a JEA session. Over-the-shoulder transcription can be configured within the session configuration file using the TranscriptDirectory parameter, as we discussed earlier in the TranscriptDirectory section.
Make sure to protect the configured folder so that its contents cannot be manipulated by an adversary. Also forward, parse, and review the transcripts regularly.
Over-the-shoulder transcription records contain information about the user, the virtual...
