If you notice that a user is performing an unauthorized or high-risk operation on a host during real-time monitoring, you can use the session blocking feature to disconnect the user from the host.

Block sessions on the Real-Time Monitoring page

  1. Find your bastion host and click Manage. For more information, see Log on to Bastionhost.
  2. In the left-side navigation pane, choose Audit > Real-Time Monitoring.
  3. On the Real-Time Monitoring page, select one or more sessions that you want to block.
    Block sessions
  4. Click Interrupt Sessions.