If you notice that a user is performing an unauthorized or high-risk operation on a host during real-time monitoring, you can use the session interruption feature to disconnect the user from the host.

Interrupt sessions on the Real-Time Monitoring page

  1. Log on to the Bastionhost system. For more information, see Log on to Bastionhost.
  2. In the left-side navigation pane, click Audit > Real-Time Monitoring.
  3. On the Real-Time Monitoring page that appears, select one or more sessions that you want to interrupt.
    Interrupt sessions
  4. Click Interrupt Sessions in the lower-left corner of the session search result list.