---
title: Set up and manage privileged user monitoring
description: Before you can start monitoring privileged users, you need to define which users in your environment are considered privileged. Privileged users typically...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup
products:
  - Elastic Cloud Serverless
  - Elastic Security
---

# Set up and manage privileged user monitoring
<admonition title="Requirements">
  To use privileged user monitoring, you must:
  - Have the appropriate user role or privileges
  - Turn on the required advanced setting
  For more information, refer to [Privileged user monitoring requirements](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements).
</admonition>

Before you can start monitoring privileged users, you need to define which users in your environment are considered privileged.
Privileged users typically include accounts with elevated access rights that allow them to configure security settings, manage user permissions, or access sensitive data.

## Define privileged users

You can define privileged users in the following ways:
- `stack: preview 9.2` `serverless: preview` [Add a supported integration](#privmon-integrations) with your organization’s user identities. If your environment is already ingesting data from a supported integration, the setup steps are skipped—you're taken directly to the Privileged user monitoring dashboard, where you can start [monitoring user activity](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/advanced-entity-analytics/monitor-privileged-user-activitites).
- [Select an existing index](#privmon-index) or create a new custom index with privileged user data.
- [Bulk-upload](#privmon-upload) a list of privileged users using a CSV or TXT file.
- Use the Entity analytics APIs to [mark individual users as privileged](https://www.elastic.co/docs/api/doc/kibana//operation/operation-createprivmonuser) or [bulk-upload multiple privileged users](https://www.elastic.co/docs/api/doc/kibana//operation/operation-privmonbulkuploaduserscsv).

To get started, find the **Privileged user monitoring** page in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/explore-analyze/find-and-organize/find-apps-and-objects).

### Add a supported integration

```yaml
stack: preview 9.2
serverless: preview
```

1. On the **Privileged user monitoring** page, select an integration. The supported integrations are:
   - [Active Directory Entity Analytics](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/entityanalytics_ad). Users in the following security groups will be automatically assigned as privileged:
  - Domain Admins
- Enterprise Admins
- [Okta Entity Analytics](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/entityanalytics_okta). Refer to [Standard administrator roles and permissions](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) for a list of Okta roles that will be automatically assigned as privileged users.
2. Follow the steps to install the integration.


### Select or create an index

1. On the **Privileged user monitoring** page, click **Index**.
2. From the **Select index** popup, you can create new or choose existing indices as your data source.
3. Select **Add privileged users**.

All user names, specified in the `user.name` field in your selected indices, will be defined as privileged users.

### Import a list of privileged users from a text file

1. On the **Privileged user monitoring** page, click **File**.
2. Select or drag and drop the file you want to import. The maximum file size is 1 MB.
3. Select **Add privileged user**.

The file must contain at least one column, with each user record listed on a separate row:
1. The first column specifies the privileged user's user name.
2. An optional second column may specify a label, representing the user’s role, group, team, or similar.

File structure example:
```txt
superadmin
admin01,Domain Admin
sec_ops
jdoe,IT Support
```

<note>
  Any lines that don’t follow the required file structure will be highlighted, and those users won't be added. We recommend that you fix any invalid lines and re-upload the file.
</note>

After setting up your privileged users, you can start [monitoring their activity](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/advanced-entity-analytics/monitor-privileged-user-activitites) and related insights on the Privileged user monitoring dashboard.
You can update the selected data sources at any time by selecting **Manage data sources**.

## Manage data sources

Use the **Manage data sources** page to update your selected data sources.
You can use multiple data source types, such as an index and a CSV file, at the same time to define privileged users. Users defined through different data source types are monitored together.
On this page, you can:
- `stack: preview 9.2` `serverless: preview` Change which integrations you're using as data sources.
- View, remove, and change indices after initially defining them.
- Import a new supported file with a list of privileged users.
  <note>
  Importing a new file will overwrite any users added from a previous file. This doesn't affect users defined through other data source types.
  </note>