SWOT PAM Administrator Guide

Comprehensive operational manual for System Administrators, Security Engineers, and Infrastructure Directors. Covers deployment, identity synchronization, policy engineering, credential vaulting, automated rotation, and live session defense.

System Overview & Architecture

SWOT PAM is an enterprise-grade Privileged Access Management solution designed on a Zero-Trust architecture. All administrative connections to sensitive resources (Linux servers, Windows desktops, databases, and cloud control planes) pass through dedicated protocol inspection proxies.

Figure 1.1 — Live SOC Dashboard

SOC Radial Drill Engine: Real-time visual interface displaying active connections, host health, threat level, and telemetry feeds. Click to zoom

Core platform capabilities include:

• Zero-Trust Protocol Proxies: Keystroke-intercepting SSH proxy (port 2222), Windows IronRDP gateway (port 33890), and SQL protocol proxies (port 5454 / 1521).
• Central Credential Vault: Hardware-grade AES-256-GCM secret store supporting one-click password/key rotation and dual-custody checkouts.
• PAMGuard Threat Engine: Live keystroke stream monitoring, regex command blocking, anomaly scoring, and automated session termination.
• Regulatory Compliance: Automated audit collection for SOC 2, ISO 27001, PCI-DSS, HIPAA, and GDPR with tamper-evident SHA-256 hash chains.

1. Deployment & Container Setup

SWOT PAM is delivered as a containerized stack comprising seven specialized microservices. In production, it runs on standard Docker engines (Docker CE 24+ or Docker EE) with Docker Compose v2.

Quick Deployment via Release Bundle

# 1. Extract the release bundle on the target server
tar -xzf swot-pam-release.tar.gz && cd swot-pam-release

# 2. Configure production secrets
cp .env.example .env
nano .env

# 3. Load prebuilt container images and launch the cluster
chmod +x deploy.sh
./deploy.sh

# 4. Verify service health
docker compose ps

2. Identity Management, MFA & Enterprise SSO

All access to the management console requires strong authentication. SWOT PAM enforces multi-factor authentication (MFA) by default for administrative roles and provides native integration with enterprise Identity Providers (IdPs).

Figure 1.2 — Authentication & MFA Screen

Authentication Gate: Secure login prompt with support for local password authentication, TOTP verification, and SSO redirection. Click to zoom

Enforcing Multi-Factor Authentication (TOTP)

Administrators can configure roles to mandate TOTP authentication. Users are guided through a QR code enrollment flow compatible with Google Authenticator, Microsoft Authenticator, and YubiKey OTP.

Enterprise SAML 2.0 & Active Directory Integration

SWOT PAM supports federated Single Sign-On (SSO) using SAML 2.0 and OpenID Connect (OIDC). Connect seamlessly with Okta, Microsoft Entra ID (Azure AD), PingFederate, and Google Workspace.

• Just-In-Time (JIT) Provisioning: New enterprise users are automatically provisioned with default viewer roles upon first successful SAML assertion.
• Group-to-Role Mapping: Map enterprise directory groups (e.g., CN=DevOps,OU=Groups,DC=corp) directly to SWOT PAM roles (devops, dba, vault_admin).
• LDAP / AD Synchronization: Scheduled background workers synchronize Active Directory user state, disabling terminated accounts immediately.

3. Custom Branding & White-Labeling

Tailor the PAM portal to match your corporate identity. Administrators can configure custom logos, application titles, accent colors, and custom login messages.

Figure 1.3 — Custom Branding Settings

White-Label Customization: Configure enterprise brand name, upload SVG/PNG logos, customize favicon, and adjust session banner alerts. Click to zoom

4. Managed Asset Inventory & Discovery Scans

The Asset Inventory represents the single source of truth for all privileged target systems under management. Supported asset classes include Linux servers, Windows servers, database instances, network switches, and cloud accounts.

Figure 1.4 — Asset Inventory

Target Inventory: Managed infrastructure table showing IP addresses, OS types, active connection count, and health status. Click to zoom

Automated Network Discovery & Auto-Onboarding

Instead of manually adding hundreds of servers, administrators can configure automated network discovery scans across enterprise CIDR blocks.

Figure 1.5 — Discovery Scanner

Automated Asset Discovery: Scan subnets, detect open SSH (22), RDP (3389), PostgreSQL (5432), and Oracle (1521) ports, and auto-onboard targets. Click to zoom

5. Zero-Trust Policy Engine & RBAC Matrix

Access permissions in SWOT PAM are governed by granular, context-aware policies. Rather than granting standing privileges, access is evaluated dynamically based on user identity, target asset, protocol, time window, and client IP range.

Figure 1.6 — Policy Engine

Security Policies: Rules defining target access permissions, dual-custody approval requirements, session timeouts, and command filtering. Click to zoom

Command Filtering & Dangerous Regex Interception

The policy engine inspects interactive terminal keystrokes in real time. Administrators can configure regex blocklists to prevent catastrophic accidents or malicious actions:

Role-Based Access Control (RBAC)

SWOT PAM provides fine-grained role definitions. System roles control who can administer assets, approve checkouts, view recordings, or execute database queries.

Figure 1.7 — Role Permission Matrix

Role Permissions: Fine-grained permission matrix controlling access to Vault, Terminal, RDP, Reports, and System Settings. Click to zoom

6. Central Vault & Automated Credential Rotation

The Central Vault securely stores passwords, SSH private keys, cloud access keys, and API tokens. All secrets are encrypted at rest using AES-256-GCM.

Figure 1.8 — Central Vault Dashboard

Vault Overview: Secret statistics, rotation compliance rate, upcoming expirations, and active checkouts. Click to zoom

Figure 1.9 — Credential Explorer

Credential Explorer: Hierarchical folder navigation, secret card details, checkout controls, and one-click reveal actions. Click to zoom

Automated Credential Rotation Engine

To prevent credential staleness, the rotation worker periodically connects to target systems and updates root/administrator passwords or rotates SSH authorized keys automatically.

Figure 1.10 — Rotation Schedules

Rotation Policies: Configure automated rotation intervals (e.g., every 30 days or immediately post-checkout), password complexity rules, and verification checks. Click to zoom

Dual-Custody Approvals & Checkouts

For highly sensitive infrastructure (e.g. production databases or PCI domain controllers), checkout requests require secondary approval before credentials can be unlocked.

Figure 1.11 — Approvals Queue

Dual-Custody Review: Security officers review pending checkout requests, check justification, and approve or reject access. Click to zoom

7. PAMGuard Live Monitoring & Threat Defense

PAMGuard is SWOT PAM's integrated threat detection engine. It continuously analyzes command patterns, user behavior, and network activity across all proxy sessions.

Figure 1.12 — Live Session Monitor

Active Sessions Table: Live view of active SSH, RDP, and Database sessions, with live duration, client IP, risk score, and terminate buttons. Click to zoom

Figure 1.13 — Real-Time Keystroke Monitor

Input Threat Stream: Real-time feed of typed terminal keystrokes, matched security flags, and instant session kill-switch controls. Click to zoom

8. Compliance Scorecards & Automated Reports

Meet rigorous regulatory requirements with automated compliance dashboards and exportable audit packages. SWOT PAM provides preconfigured mapping for SOC 2, ISO 27001, PCI-DSS, HIPAA, and GDPR.

Figure 1.14 — Compliance Hub

Compliance Scorecards: Real-time regulatory compliance indicators, audit logs, and automated PDF/CSV report generation. Click to zoom

9. Container Lifecycle & System Health

Administrators can monitor the operational health of each container service directly from the web interface without requiring host-level SSH access.

Figure 1.15 — Container Management

Container Operations: Status, CPU/memory consumption, uptime, log viewing, and graceful restart controls for all PAM services. Click to zoom