CyberArk PSM Session Recording Search: How to Find the Evidence You Need in an Incident Investigation

Navigate to the PVWA interface and select the Monitoring menu item. The Session Management sub-menu contains All Sessions, which displays all PSM recordings in the vault that the current user has access to view.

The primary filter options:

• Vault User: the CyberArk user who initiated the session (the human or service principal that logged into PVWA and launched the session). This is the most reliable filter for investigating a specific administrator.
• Target Account: the privileged account used in the session (for example, root on server01 or Administrator on sqlserver02).
• Remote Machine: the target system's hostname or IP address.
• Date Range: From and To date pickers for the session start time.
• Safe: limits results to sessions from accounts stored in a specific Safe.

Apply the most restrictive filter first to limit results. If you know the Vault User, start there. If you know the target system, filter by Remote Machine and date range. Combining multiple filters with AND logic narrows large result sets quickly.

For each session result, the list shows: session start time, duration, Vault User, target account, remote machine, and whether a recording file exists. Some sessions may show no recording if the session was initiated through a connection component that does not record, or if PSM storage was temporarily unavailable.

CyberArk PSM can index recording content and allow text search across sessions, but this capability has specific prerequisites that many deployments do not meet.

For RDP sessions: text indexing is performed by an OCR engine on the PSM server that processes the recorded screen content. This requires: Allow recording and text indexing to be enabled in the Master Policy for the relevant platform, and the PSM server to have sufficient disk space for the index files (index files are approximately 20 to 30 percent of the recording file size). If these are configured, the text search box in the Session Management view allows free-text queries across RDP session content.

For SSH terminal sessions: SSH text indexing uses a separate mechanism because SSH sessions are recorded as text streams rather than screen captures. The PSM for SSH component must have textual session recording enabled in its ini configuration (PSMPServer.ini: EnableAuditLogs = yes). This is a separate configuration from the PSM RDP recording and is not enabled by default. Without it, SSH session text is not searchable even if RDP sessions are.

For sessions recorded before the indexer was configured: OCR indexing is not retroactive. Recordings that were stored before the indexer was configured are not indexed and will not appear in text search results. Only recordings created after indexer configuration are searchable by text content.

The practical implication for incident investigation: if you are investigating an SSH session from before the indexer was configured, you must review the session recording manually by playing it back. For large investigation scopes, this significantly extends the investigation timeline.

The PVWA interface returns 25 sessions per page and requires manual navigation for large result sets. For an investigation covering hundreds of sessions across weeks of activity, the REST API is the correct approach.

Authenticate first: POST /PasswordVault/API/auth/CyberArk/Logon with your CyberArk credentials. The response returns a token used in the Authorization header for subsequent calls.

Retrieve session metadata: GET /PasswordVault/API/Recordings?Limit=100&Offset=0&FromTime=[unix_epoch]&ToTime=[unix_epoch]

Additional filter parameters: UserName (Vault User filter), AccountID (specific privileged account), SafeName, RemoteMachine.

The response JSON includes: SessionID, StartTime, EndTime, User, AccountName, AccountAddress, TicketID (if approval workflow was used), Duration, and RecordingFiles (list of recording file references).

Paginate through results by incrementing Offset by the Limit value (Offset=0, then Offset=100, then Offset=200) until the response returns fewer results than the Limit value.

Export the metadata to CSV for triage: parse the JSON response in PowerShell with ConvertFrom-Json and export with Export-Csv. The CSV gives investigators a sortable list of all sessions with their duration and account details, allowing them to prioritize which recordings to review manually based on session duration and account privilege.

Once the metadata triage identifies high-priority sessions, retrieve the recording files.

From PVWA: click a session in the All Sessions list and use the Play button to stream the recording within the browser, or the Download button to retrieve the file locally. Downloaded recordings play in the CyberArk Privileged Session Player application, which provides frame-by-frame navigation, speed adjustment, and event markers.

From the REST API: the RecordingFiles array in the session metadata contains file references. Use GET /PasswordVault/API/Recordings/{SessionID}/Activities to retrieve the activity log for a session, which lists detected events (mouse clicks, keyboard input markers, command detection results) with timestamps. This activity log allows you to jump to specific timestamps in the recording without watching the full session.

For RDP sessions, the Player application's event marker timeline is the most efficient review tool. If command detection was configured in the PSM settings, specific commands run during the session are marked on the timeline, allowing you to jump directly to the point where a specific command was executed.

For SSH sessions, the text recording (if enabled) can be opened as a plain text file and searched with any text editor, which is faster than video playback for identifying specific command sequences.