Features — Session Monitoring, Threat Scoring & Automated Protection

SOC Dashboard

Real-time security overview. Active sessions, recent alerts, blocked IPs, fleet status — all in one view. Dark theme with severity-colored indicators.

soc-dashboard

Live Session Monitoring

Watch PTY sessions in real-time with behavioral scoring. See every keystroke as it happens, cumulative threat scores climbing live. One-click session kill when things go wrong. Full command history for forensics.

session-monitor

One-Click Blocking

Block users, IPs, sessions, and keys with a single click. Kill active sessions instantly. Block IPs fleet-wide or per-scope. Revoke SSH keys across all hosts. Block specific commands via denied pattern lists.

one-click-blocking

Fleet Health + Service Alerts

CPU, RAM, disk, swap across your entire fleet at a glance. Service monitoring for MySQL, PostgreSQL, Redis, Kafka, MongoDB, RabbitMQ, Node.js, Python, Java, cron jobs. Instant alerts when critical services go down. Outward connection monitoring.

fleet-health

Lateral Movement Detection

SSH-from-SSH chain visualization. Traces attacker pivot paths across hosts. Multi-hop tracking with entry point identification. Outward connection monitoring and blocking — detect and stop data exfiltration.

lateral-movement

SSH Key Management

Centralized key lifecycle across your fleet. One-click deploy, revoke, set TTL expiry. Weak key detection, duplicate detection, stale key alerts. Key drift detection flags unauthorized additions. Dashboard-only writes with kernel enforcement.

ssh-keys

SSO Integration

Single sign-on via Okta, Microsoft Entra ID, and Google. MFA (TOTP) for all accounts. Device trust verification. No separate identity provider to manage — works with what your team already uses.

sso-integration

One-Click Compliance Reports

Generate audit-ready compliance reports with one click. SOC 2 (CC6.1, CC6.2), PCI-DSS (Requirement 10), HIPAA, FedRAMP, ISO 27001 (A.12.4). Immutable session recordings, hash-chained audit logs, file integrity monitoring — everything auditors ask for.

compliance-reports

Incident Response

Full incident management workflows: Open, Investigating, Contained, Resolved. Create incidents from alerts. Host actions: process tree, network connections, host isolation, forced reboot. Timeline, comments, team collaboration.

incident-response

SIEM/Syslog Forwarding

Forward events to your existing SIEM/SOAR stack. Syslog, webhook, Slack, PagerDuty, email routing. Structured event data for Splunk, Elastic, Datadog, or any syslog consumer. Never lose visibility in your existing tooling.

siem-forwarding

Audit Log

Immutable, searchable audit trail for every action. Who did what, when, from where. Required for compliance frameworks: SOC 2, PCI-DSS, HIPAA, FedRAMP, ISO 27001. Session recordings are hash-chained and tamper-proof.

audit-log

Command Blocking

Define custom deny-lists to block dangerous commands before they execute. Per-scope policies: different configurations for production vs staging vs development.

command-blocking

shellarmor --compliance-status

Compliance audits don't fail because logs are missing — they fail because you can't prove what actually happened. Login records only show who accessed a system, not what they did. That gap is exactly where breaches, insider threats, and audit findings live. SSH session logging closes this gap by providing complete, tamper-proof visibility into every privileged action, making audits faster, investigations conclusive, and compliance defensible.

Session Log Retention Requirements

FRAMEWORK	RETENTION REQUIRED	REGULATION
PCI DSS	1 year total (≥3 months immediately available)	Requirement 10.7: "Retain audit log history for at least one year, with a minimum of three months immediately available for analysis."
HIPAA	6 years	45 CFR §164.316(b)(2)(i): "Retain the documentation for 6 years from the date of its creation or the date when it last was in effect, whichever is later."
SOX	7 years	Section 802 (18 U.S.C. §1519): "Requires retention of audit or review workpapers and related records for a period of 7 years."
ISO/IEC 27001	No fixed duration (policy-defined)	Annex A.12.4.1: "Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed."
NIST SP 800-53	No fixed duration (organization-defined)	AU-11: "Retain audit records for an organization-defined time period consistent with records retention policy to provide support for after-the-fact investigations."
SOC 2	No fixed duration (based on business/audit needs)	CC7.2 / CC7.3: "The entity monitors system components and the operation of controls to identify anomalies and events and evaluates them to determine whether they represent security incidents."
CIS Controls	≥90 days (recommended ≥1 year)	Control 8.2: "Collect audit logs from multiple sources; retain logs for at least 90 days and consider longer retention to support investigations."
CMMC	No fixed duration (organization-defined)	AU.L2-3.3.1: "Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity."
DORA	5 years (minimum)	Article 12(3): "Financial entities shall retain ICT-related records for a minimum of five years, or longer if required by national rules."

shellarmor-retention

ShellArmor log retention:

  Free:       30 days hot   |  no cold storage
  Pro:        90 days hot   |  1 year cold storage
  Enterprise: 365 days hot  |  7 years cold storage

Cold storage uses compressed archives (JSONL.zst daily + XLSX monthly).
Meets HIPAA 6-year and SOX 7-year requirements out of the box on Enterprise.
All session recordings are immutable and hash-chained — tamper-proof by design.