Mirket Privileged Access Management (PAM) Technical Guide is Ready For You!
What is PAM how does Mirket Privileged Access Management (PAM) work? Agentless RDP/SSH access, password vault, command policy, and searchable session recording with Mirket PAM. Technical specifications and licensing model.
Privileged Access Management (PAM) is a system that controls and records how administrators access servers. Mirket Privileged Access Management achieves this without installing agents on target servers, without exposing passwords to users, and by recording every session as searchable text. In this guide, you will find out what PAM is, how Mirket PAM works, and its technical features.
What is Privileged Access Management (PAM)?
Privileged Access Management (PAM) is a security layer that controls and records how administrators access systems. Instead of connecting by knowing the administrator password, users are authorized for a specific target; credentials are injected into the session on behalf of the user, the session is recorded, and every action is linked back to an individual.
Why do organizations use Privileged Access Management?
Critical accounts such as domain administrators, Linux root, firewall management accounts, or database owners are often shared, their passwords are rarely changed, and they are prime targets for attackers. The four main problems PAM solves are:
| Problem | Result | PAM's Response |
|---|---|---|
| Six people use the same admin password | The log shows the account connected, but not which person performed the action | Every session is linked to a user and recorded |
| Passwords spread across scripts, configs, and memory | They can leave the organization with anyone who knows the password | The password is kept in the vault, injected into the session, and not shown to the user |
| A single account is enough | A compromised admin password works on all servers accepting that password | MFA upon privilege elevation, just-in-time access, automatic password rotation |
| Proof is required for auditing | "Who accessed this server and what commands did they run?" cannot be answered with a list of accounts | Video recording and searchable command transcripts |
How does Mirket Priviliged Access Management work?
Mirket Priviliged Access Management operates without installing agents on managed servers. Targets are registered as assets; the user is authenticated with MFA, passes through policy and Role-Based Access Control (RBAC) checks, credentials are injected into the session, and the session is monitored and recorded in real time. Suspicious behavior can automatically terminate the session, and an authorized user can join a live session.
-
1. Discovery
Domain-joined servers are inventoried along with their operating systems, OUs, and local accounts.
-
2. Account Mapping
Defined as "this user connects to this system using this account"; the user selects the target, not the password.
-
3. Session Policy
Allow, deny, or require approval based on user/group, target, and schedule.
-
4. Session Initiation
Credentials are injected and never displayed.
-
5. Recording
The session is recorded as video and text transcript.
How do administrators connect in Mirket Privileged Access Management?
There are three access paths, and the same policy, credential injection, and recording apply to all of them:
| Access Path | Protocols | Client Installation |
|---|---|---|
| Isolated browser (HTML5) | RDP, SSH, web consoles | Not required |
| One-time launcher | Native RDP (Microsoft Remote Desktop), Native SSH (PuTTY on Windows, Terminal on macOS), SFTP | Not required |
| Mirket agent | Built-in RDP and SSH tools | Required |
Once generated, the launcher file must be executed within one minute and can only be used once. Web interfaces such as firewalls, hypervisors, or backup consoles are also opened in the same isolated browser; Mirket enters the credentials, and the user does not see them.
What are the technical features of Mirket PAM?
Mirket PAM delivers password vaulting, session and command policies, just-in-time access, session recording, and inventory discovery within a single platform. The features are grouped into four categories.
Credential Management
| Feature | Technical Behavior |
|---|---|
| Password vault | Privileged account passwords are stored and injected into sessions |
| Automatic password rotation | Per-account schedules; defines day ranges and exact times |
| SSH key management | Key pairs are centrally stored and rotated |
| Secret vault & credential provider | Application secrets are stored encrypted and requested at runtime |
| Glass Break | Emergency package with encrypted, one-time recovery passwords |
Session Security
| Feature | Technical Behavior |
|---|---|
| Command policy | Closed, blacklist, or whitelist; audit log, block, or terminate the session |
| MFA on privilege elevation | Re-authentication or administrator approval within the session |
| Just-in-time (JIT) access | Requires justification, approver, and duration; no one can approve their own request |
| Clipboard and file transfer | Input/output and upload/download are authorized separately |
The command policy applies to any session containing a command line: RDP, SSH, device CLI consoles, or database clients published via RemoteApp.
Recording and Auditing
| Feature | Technical Behavior |
|---|---|
| Session recording | Video in both native and browser sessions; idle periods are skipped |
| Command transcript | Searchable, filterable, and exportable to CSV; clicking a command jumps the player to that exact moment |
| Live session view | See who is connected where; option to join or terminate sessions |
| Reports | User and asset-based, schedulable, and deliverable via email |
| Access matrix | Who can access which system and with which account |
Inventory Discovery
Asset discovery imports domain-joined servers via ping and WinRM availability. Account discovery lists local accounts along with their last logon and group memberships. Scheduled re-discovery runs daily, weekly, monthly, every N hours/minutes, or via cron expressions.
How is Mirket PAM deployed and licensed?
Mirket Privileged Access Management runs entirely on-premise on Linux; it does not require a separate Windows jump server or additional OS licenses. If Mirket Portal is already deployed for MFA, SSO, or Self-Service, PAM simply operates as a module of this portal. High availability is provided by an active-passive pair: the standby node syncs continuously and takes over if the active node becomes unresponsive.
Licensing can be either per user or per concurrent session; you choose one or the other. There is no per-asset licensing, so you pay for users rather than managed servers. A separate ZTNA license is not required for internal access; the Mirket Native Client is included in PAM.
How does PAM contribute to compliance requirements?
No product alone provides regulatory compliance. Mirket PAM produces evidence for the requirements evaluated for privileged access:
| Standard | Clause | Evidence |
|---|---|---|
| PCI DSS v4.x | Requirements 7 and 8 | Role-based access, individual user attribution, access matrix |
| PCI DSS v4.x | Requirement 10 | Session video and command transcripts |
| ISO/IEC 27001:2022 | A.8.2, A.8.15, A.8.18 | Privileged access rights, logging, utility program usage |
| NIS2 | Article 21 | Access control, MFA, asset management |
What should you test in a Proof of Concept (PoC)?
1. Ask for three session recordings, not one. Separately verify the recording of a native RDP session, a native SSH session, and a web console (firewall, hypervisor, or backup system). Scope often falls short on the third one.
2. Do not consider an unsearchable recording as evidence. Search for a specific command, verify that the player jumps to that exact moment, and confirm that a blocked command terminates the session.
Frequently Asked Questions
Q: Does Mirket PAM require installing agents on managed servers?
No. Target systems are registered as assets and accessed via RDP, SSH, or a browser through Mirket. Nothing is installed on the protected servers. Of the three access paths on the administrator side, only the Mirket agent requires client installation.
Q: Can administrators connect using their own RDP and SSH clients?
Yes. The launcher generated by the portal opens native RDP via Microsoft Remote Desktop on Windows and macOS, and native SSH via PuTTY on Windows and Terminal on macOS; SFTP operates under the same authorization. The launcher must be executed within one minute and is single-use.
Q: Does Mirket PAM record RDP and SSH sessions?
Yes. It records both video and searchable text, doing so not just for browser sessions but also for native RDP and SSH sessions.
Q: Can I search session records by command?
Yes. Along with the video, a text transcript is produced for every session. Transcripts can be searched, filtered, and exported to CSV; when you search for a command, the player skips to the moment the command was typed.
Q: Can the execution of specific commands be blocked?
Yes. The command policy in blacklist or whitelist mode can generate an audit log upon a match, block the command, or terminate the session. The policy applies to any session with a command line, including RDP, SSH, device CLI consoles, and database clients published via RemoteApp.
Q: Can Mirket PAM store passwords in a vault and rotate them automatically?
Yes. Passwords are centrally stored, injected into the session without being shown to the user, and changed according to an account-specific schedule. SSH key pairs are similarly stored and rotated.
Q: What is just-in-time (JIT) access?
Instead of granting permanent privileges, it is access that opens for an approved time window and expires when the time runs out. In Mirket, every request requires a justification and a specified approver; no one can approve their own request, and access can be revoked before it expires.
Q: Can privileged access be granted to third-party vendors?
Yes. Instead of giving a vendor engineer a network-wide VPN account, a recorded session valid only for a limited time can be established to the specific equipment they support.
Q: Does Mirket PAM run in the cloud?
No. PAM operates exclusively on-premise; session records and transmitted credentials remain on your own servers. However, MFA, SSO, and Secure Self-Service can be provided either on-premise or as a service.
Q: How is Mirket PAM licensed?
Per user or per concurrent session; you choose one. There is no per-asset licensing. The Mirket Native Client is included in PAM, and a separate ZTNA license is not needed for internal access.
Try Mirket PAM in Your Environment
Contact us to request technical demos, schedule a PoC, or securely automate your internal authorization processes.
Explore Mirket →