> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SWIFT Username Monitoring

> Monitor users logged in to the SWIFT financial network from Syteca-monitored endpoints - for SWIFT Customer Security Programme (CSP) compliance and audit trails on SWIFT access.

## Cover SWIFT Customer Security Programme requirements without bolting on a niche product

The SWIFT Customer Security Programme (CSP) is the financial industry's standard for monitoring access to the SWIFT network. Its **CSCF (Customer Security Controls Framework)** requires institutions to track who logs in to SWIFT-related systems, when, from where, and what they do - both for active threat detection and for audit evidence after the fact. Generic UAM products don't typically know what "SWIFT login" means; they capture screen and metadata generically. Dedicated SWIFT monitoring products exist but are expensive and live outside the broader security stack.

**Syteca's SWIFT Username Monitoring captures SWIFT login identity** as a first-class data field - the username used to log in to the SWIFT network on a monitored endpoint is logged separately from generic OS/application login data, written to a dedicated log file on the Application Server, and (with SIEM integration enabled) forwarded into the SIEM alongside other Syteca security events. Same Client agent that's already running for general session monitoring; an additional feature flag turns SWIFT capture on.

<Info>
  **Use SWIFT Username Monitoring when you need to:**

  * **Meet SWIFT CSP CSCF controls** for tracking access to SWIFT-related systems (specifically the controls around session monitoring and user accountability).
  * **Provide auditors with a dedicated SWIFT access trail** separate from general session logs - easier evidence handover during SWIFT CSP attestations.
  * **Feed SWIFT login events into your SIEM** alongside other security telemetry - for correlation with other indicators of compromise or insider risk.
  * **Run unified UAM + SWIFT monitoring on the same Client** without licensing a separate SWIFT-specific product.
</Info>

<Note>
  **Applies to**: Windows Clients, macOS Clients. The feature is configured on the **Monitoring \[Windows/macOS]** tab, indicating it's available on both platforms.
</Note>

## Two-step enablement

SWIFT username monitoring requires both an Application Server-side feature flag **and** a per-Client checkbox.

### 1. Enable the feature on the Application Server

Enable SWIFT username monitoring in the Application Server **.config** file. See [Enabling SWIFT username monitoring](/docs/administration/deployment/server-advanced-settings#enable-swift-username-monitoring) for the canonical procedure.

<Warning>
  **In SaaS only**: Contact your Syteca vendor or the Syteca Support team to enable this feature in your environment - SaaS customers don't have direct access to the Application Server `.config` file.
</Warning>

### 2. Enable per Client / Client group

Select the **Enable SWIFT username monitoring** checkbox on the **Editing Client** / **Editing Client Group** page, on the **Monitoring \[Windows/macOS]** tab, in the **Monitoring Parameters** section at the top.

## What gets logged

When both Step 1 and Step 2 are configured for a Client, the user name used to log in to the SWIFT network on that Client computer is written:

| Destination                                                                             | Format                                                                                                 |
| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| **Separate log file on the Application Server computer**                                | Plain text log file maintained for SWIFT login events specifically                                     |
| **SIEM system** *(if [SIEM integration](/docs/administration/integrations/siem) is enabled)* | Forwarded according to your SIEM integration settings - Syslog / CEF / LEEF depending on configuration |

The SWIFT username is captured **in addition to** all standard Syteca monitoring data - session recordings, clipboard data, application metadata. SWIFT capture doesn't replace any other monitoring stream.

## Compliance context

SWIFT CSP CSCF control 7.2 (Session Monitoring) and adjacent controls require institutions to monitor SWIFT operator activity. Syteca's SWIFT username capture, combined with general session recording, contributes evidence toward these controls. **Consult your SWIFT CSP attestation requirements and your auditor - Syteca's documentation describes the technical capability, not the compliance interpretation.**

## Related

<CardGroup cols={2}>
  <Card title="SIEM integration" icon="cable" href="/docs/administration/integrations/siem">
    Forward SWIFT events into your SIEM alongside other security telemetry.
  </Card>

  <Card title="User activity recording" icon="video" href="/docs/session-monitoring/recording/user-activity-recording">
    The full session recording that runs alongside SWIFT-specific capture.
  </Card>

  <Card title="Audit log" icon="scroll-text" href="/docs/administration/audit-log">
    Administrative audit trail - what admins did in Syteca itself.
  </Card>

  <Card title="Application Server settings" icon="settings" href="/docs/administration/deployment/server-advanced-settings">
    Other .config file settings on the Application Server.
  </Card>
</CardGroup>