Quick Start Guide to Live Sessions
The Live Sessions section provides real-time visibility into the network traffic processed by your Zenarmor deployments. Unlike the Reports workspace, which focuses on aggregated and historical analytics, Live Sessions allows you to inspect individual network connections as they occur, making it an essential tool for troubleshooting, traffic investigation, and security analysis.
Whether you are investigating a blocked connection, verifying policy enforcement, or monitoring active network traffic, Live Sessions provides detailed connection-level information from a single workspace.
Figure 1. Live Sessions
The Live Sessions workspace is organized into two primary views: Centralized Live Sessions and Gateway Live Sessions.
Centralized Live Sessions
Centralized Live Sessions provides a unified view of active network sessions collected from all gateways and endpoints connected to your organization.
Figure 2. Centralized Live Sessions
This view is useful when monitoring network activity across the entire environment or investigating events that may involve multiple deployments.
From this view, you can analyze Connections, Threats, Blocks, Web, DNS, and TLS sessions across the organization.
Gateway Live Sessions
Gateway Live Sessions provides visibility into the network sessions processed by a specific gateway.
Figure 3. Gateway Live Sessions
This view is useful when troubleshooting a particular site or deployment, allowing you to investigate traffic, security events, and policy enforcement for an individual gateway.
After selecting a gateway, Live Sessions displays only the sessions processed by that deployment, helping you focus your investigation on a specific location or network.
Understanding Live Sessions
Both Centralized Live Sessions and Gateway Live Sessions provide the same report views, including Connections, Threats, Blocks, Web, DNS, and TLS.
Selecting a report view updates the displayed sessions, allowing you to investigate different types of network activity without leaving the Live Sessions workspace.
The toolbar provides controls for filtering, searching, and customizing the displayed session data. Using these controls, you can narrow results, adjust the displayed time range, refresh live data, and focus on the connections that are most relevant to your investigation.
Selecting an individual session opens additional connection details, including source and destination information, detected applications, applied policies, traffic statistics, and other session attributes that help explain how the connection was processed.
For detailed information about using Live Sessions and its available report views, refer to the Live Sessions documentation.