---
title: Monitoring and Auditing OT/ICS Sessions
slug: kronpam-reference-guide-3-9-0/monitoring-and-auditing-otics-sessions
docTags: 
createdAt: 2026-05-11T09:54:48.518Z
---

### Active Session Management

Administrators can manage ongoing OT/ICS Session Manager connections in real-time.

1.      Navigate to **Policy > Active Sessions**.

2.      The list will display active TCP connections, showing the Host IP, Host Name Protocol (TCP), User, Client IP, Instance Name and Session Start Time.

3.      Administrators can select an active session and click **Kill Selected Sessions**. This immediately breaks the TCP stream and closes the connection.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/INUb48rFglpj2aeyzaFwG_image.png "Figure - Active Session Management")

### Session Logging

Every OT/ICS connection is logged for compliance and post-incident analysis.

1.      Go to Logging > Session Logs.

2.      Each entry includes the Session Start/End Time, Total Duration, and the Instance Name that identifies the  user.

3.      These logs provide a definitive record of who accessed which OT/IT resource and for how long.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/kbLO7SOYMY3ubR2IqgN_v_image.png "Figure-OT/ICS Session Logs")

### Traffic Analysis

Because OT/ICS Session Manager handles raw data, Kron PAM can generate packet capture files for detailed analysis.

1.      In **Session Logs**, click the **Actions** icon for a specific TCP session.

2.      Select **Download PCAP File**.

This file can be opened in tools like Wireshark to inspect the actual data exchanged during the session.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2wIiSr5jNGILDZRO7dEMg_image.png "Download PCAP File")