Hi,

To this day we have rules created for the RDPrelay command by capturing the information in the Command Control Reports. By default the control command captures the start and end of any computer session, the idea is to enable capture for RDP Direct for any computer.

Thanks!