Skip to main content
Granting an investigator access to one alert used to mean granting them access to every session recorded on that endpoint. From 7.28.400, session visibility can be scoped to just the sessions that triggered an alert. This page explains how the final answer is reached, because it comes from two independent inputs rather than one setting. If you are looking for what an individual permission grants, see Endpoint permissions and Administrative permissions.

​
How session visibility is decided

Two things are decided separately: A user can therefore see that a session exists, and the alert that fired in it, without being able to watch it. That combination is deliberate: it lets an auditor confirm an incident was recorded without granting them the recording itself.
The two Endpoint permissions and the administrative permission are independent. Neither Endpoint permission implies the administrative one, and the administrative one on its own reveals no sessions.

​
The two Endpoint permissions

An alerted session is a session for which at least one alert event was triggered and associated with it. Granting both is the same as granting Viewing All Monitoring Results alone: the broader grant wins. Granting neither reveals no sessions on that endpoint at all.
Visibility is evaluated per endpoint and endpoint group, not globally. A user can hold Viewing All Monitoring Results on one endpoint group and Viewing Alerted Sessions on another, and will see all sessions from the first and only alerted sessions from the second. There is no single deployment-wide setting that overrides this.
Viewing Alerted Sessions is enabled by default for the built-in admin user and for the Administrators endpoint group. It is disabled by default for every other newly created user or group.

​
Session visibility matrix

​
Archived sessions

Archived sessions add a third input: the administrative Viewing Archived Data permission. Without it the Archived Sessions page is inaccessible, including by direct URL, whatever Endpoint permissions the user holds.
Viewing Archived Data lists archived sessions. It does not open them. A user can hold it, see the archive listed, and still be unable to play anything in it, because playback needs Viewing Monitoring Results as well.

​
Where the scoping shows up

For a user who holds the administrative Viewing Monitoring Results permission, every page that reports on sessions is limited to the sessions that user is allowed to see:
Where a user’s permitted session set for an endpoint is empty, these pages show a correct empty state for that endpoint. They do not show an error, and they do not fall back to showing everything.

​
Worked examples

Grant Viewing Alerted Sessions on the endpoint groups in scope, plus the administrative Viewing Monitoring Results.They see and can play sessions where an alert fired, generate reports and dashboards covering those sessions, and nothing else. Sessions with no alert are not listed for them.
Grant Viewing Alerted Sessions and withhold the administrative Viewing Monitoring Results.They see that alerted sessions exist and which alerts fired, and cannot open any of them. The Dashboards, Reports, Activity Monitoring, File Upload Monitoring, and Forensic Export History pages are unavailable.
Grant Viewing All Monitoring Results on the endpoint group for one region and Viewing Alerted Sessions on another, to the same user.Everything is visible in the first region, and only alerted sessions in the second. Visibility is worked out per endpoint group, so the narrower grant is not widened by the broader one elsewhere.
If the Endpoint Sessions page is empty, check the Endpoint permissions first. Holding the administrative Viewing Monitoring Results alone reveals no sessions: it opens the pages, but something has to populate them.

Endpoint permissions

Viewing Alerted Sessions, Viewing All Monitoring Results, and the rest.

Administrative permissions

Viewing Monitoring Results and Viewing Archived Data.

Users and user groups

Where these permissions are granted.

Alerts

What makes a session an alerted session.

Sessions list

The Endpoint Sessions page this scoping applies to.

Archived sessions

How the archive is scoped separately.