In a rule using “Privileged Session Analysis and Response” in PTA, which session options are available to configure as responses to activities?

Within the CyberArk Privileged Threat Analytics (PTA) security rule configuration for "Privileged Session Analysis and Response," administrators can define automated actions to be taken on a live privileged session when a rule is triggered. The available direct session response options are to Suspend the session, which pauses it for review by an authorized user; Terminate the session, which immediately ends it; or take None action, which logs the event and creates an alert without interfering with the session. These options allow for a tiered response based on the detected risk.

B. Suspend, Terminate, Lock Account: "Lock Account" is an action performed on a user's account within the Vault, not a direct response option for a live session in the PTA rule configuration.

C. Pause, Terminate, None: "Pause" is not the official terminology used in the CyberArk interface for this function; the correct and available option is "Suspend".

D. Suspend, Terminate: This option is incomplete because it omits the "None" action, which is a valid and the default choice for a response.

1. CyberArk Privileged Threat Analytics Implementation Guide (Version 13.0)

Section: "Configure PTA Rules". In the rule creation wizard

under the "Response" tab for a "Privileged Session Analysis and Response" rule

the guide details the available actions. The documentation explicitly lists the radio button options as "None"

"Suspend session"

and "Terminate session". This directly confirms that A is the correct set of available choices.

2. CyberArk Privileged Threat Analytics Documentation

Section: "Security Rules". This section describes the components of a PTA rule

including the response. It states

"For privileged sessions

you can configure an automatic response to either suspend or terminate the session." It also implicitly includes "None" as the default behavior of only alerting.