What to forward
The gateway sees every privileged session, which makes its logs unusually dense with meaning. Prioritise:
| Event | Why it matters |
|---|---|
| Authentication success and failure | The baseline for every detection below |
| MFA challenge outcome | Repeated denials indicate credential compromise in progress |
| Session open and close, with target and account | The attribution record: who, what, as whom, for how long |
| Commands executed | The highest-value stream for detection |
| File transfers, with hash and direction | Exfiltration and unauthorised change |
| Authorisation changes | Privilege escalation frequently begins as a grant nobody reviewed |
| Approval decisions | Who approved what, and whether anyone approved their own request |
| Configuration drift on the gateway | Someone weakening the control itself |
Structure it for correlation
Free-text log lines are cheap to produce and expensive to use. Emit structured events with consistent field names, and make sure two fields are always present and always distinct: the human who authenticated, and the account used on the target.
Conflating them is the most common integration mistake, and it destroys exactly the attribution the gateway exists to create. "Session as oracle" is useless. "m.reyes as oracle" is the whole point.
Detections worth building
Start with a small set that produces few false positives and real findings:
- Access outside declared hours — a privileged session at 03:00 from an account that has only ever worked business hours
- New target for an operator — first-ever connection to a system they have never touched, especially a sensitive one
- Failed then succeeded elsewhere — repeated denials on one account followed by success from a different source
- High-risk command executed — log clearing, user creation, mass deletion, key material access
- Recording gap — a session with no recording where policy requires one; this is a control failure, not a session anomaly
- Approval anomaly — self-approval attempts, or approvals granted seconds after request at unusual hours
- Grant widening — an authorisation changed to cover all accounts or all assets
Volume is the enemy
A gateway can produce enormous quantities of low-value telemetry. Every event forwarded and never queried costs licence, storage, and attention — and attention is the scarce one. Analysts stop reading channels that mostly contain noise, which means the volume you added actively reduces the chance of noticing the event that mattered.
Send the security-relevant stream to the SIEM. Keep full session recordings in the evidence store, referenced from the SIEM event by identifier rather than shipped into it.
Tie alerts to a decision
Before building a detection, answer what someone will do when it fires at 2am. If the honest answer is "note it and look tomorrow," it is a report, not an alert. Reports are legitimate and cheap; alerts have a budget, and spending it on things nobody acts on is how real alerts get ignored.