You can quickly sort and visualize the distribution of the sessions based on their various metadata, for example, username, server address, and so on.
To display statistics on search results
-
Click the 
icon.
-
Select the type of metadata you want to create statistics on from the Value distribution based on field, for example, select Username to display sessions based on username.
Figure 16: Audit > Sessions — Displaying statistics
-
To exclude items from the pie chart, click the 
icon next to the metadata you want to exclude.
For example, if you want to exclude results by a user called testbot, select the icon next to the item.
Figure 17: Audit > Sessions — Excluding items from the pie chart
The pie chart now does not display results for the excluded item. The percentages always add up to 100%.
You can continue to restrict or refine your search results and view statistics as required.
View the session details of each session for in-depth information on each of the indexed session stored in the connection database. You can use it to gain contextual insight about the indexed session and its events.
You can view session details for data recorded by:
-
One Identity Safeguard for Privileged Sessions (SPS). For more information, see Viewing session details for data recorded by SPS in the Administration Guide.
-
One Identity Safeguard for Privileged Passwords (SPP). For more information, see Viewing session details for data recorded by SPP in the Administration Guide.
Frequent Item Set (FIS) flow view visuals
Frequent Item Set (FIS) flow view visuals are also available on the Analytics tab. The FIS flow view is similar to the flow view analytics overview, except that the FIS flow view only displays data narrowed down to a single user's previous sessions in the analysis period (which is the previous 90 days by default). For more information, see Visualizing Frequent Item Sets on the FIS flow view in the Administration Guide.
Session tags
Session tags allow you to get basic information about the session and its contents at a glance.
Scripted session tag: One Identity Safeguard for Privileged Sessions (SPS) currently supports the scripted session tag. SPS uses One Identity Safeguard for Privileged Analytics to detect if sessions are generated using human interaction or automation. If sessions are generated using automation, SPS displays the scripted tag in the search interface as shown below:
-
Scripted sessions are shown on the main search screen.
Figure 18: Scripted sessions — cards view
-
Scripted sessions are shown on the Overview tab.
Figure 19: Scripted sessions — Overview tab
