Expose Session GUID in Hub SIEM Cmdlets

Expose Session GUID in Hub SIEM Cmdlets

1 vote

avatar

Why this is needed
Due to the lack of a central method for viewing all Devolutions Gateway session recordings across multiple Gateway servers, we are developing an internal solution to collect recording metadata from each Gateway.

To correlate recordings with session activity, we need to match the Session GUID contained within the recording metadata to the session information returned by the Hub SIEM PowerShell cmdlets.

Currently, there is no supported method to perform this correlation.

Requested Enhancement
Add the Gateway Session GUID (SessionId) to the output of the following PowerShell cmdlets:

  • Get-HubSiemLogsDaily
  • Get-HubSiemLogsWeekly
  • Get-HubSiemLogsMonthly


Technical Requirement
The Session GUID returned by the SIEM cmdlets should match the Session GUID embedded within Gateway session recording metadata.

This would allow customers to:

  • Correlate Gateway recordings with SIEM log entries.
  • Associate recordings with users, accounts, vault entries, approvals, and session events.
  • Perform audit, compliance, and forensic investigations using supported APIs and cmdlets.
  • Eliminate the need for unsupported workarounds to match recordings to session activity via timestamps.


Expected Outcome
A unique Session GUID field is included in the SIEM cmdlet output, allowing direct correlation between Gateway session recordings and the corresponding Hub session records.

All Comments (1)

avatar

Hi @bbultitude,

We'll look into adding recording IDs to the session opened logs. I've opened a ticket with the development team and we'll update this thread once we have something to share.

Cheers,

Luc Fauvel