Section 06
Users: Live Sessions
Who is active right now and what they are doing, in near-real-time.
The Users page shows who is active right now and what they are doing. It is the live-activity companion to the historical view in Reports.
What you see
A Live (last 5 min) view with a window toggle (5m · 15m · 1h · 24h) and a Refresh control. Summary cards show Active Users, Conversations, Events and Flagged for the selected window, above a list of the active sessions themselves.
How to use it
Widen the window (15m / 1h / 24h) to see beyond the immediate moment; use Flagged to spot sessions that tripped a policy and drill into what happened. This is the page to watch during an incident or a change window.
Live Sessions is a monitoring view and is read-only for both roles.
New appliance. On a newly set-up appliance there are no sessions yet, so the page shows "No active sessions in the last 5 minutes." That is normal; sessions appear as users route traffic through the appliance.
Still stuck? Submit a ticket and reference this page.