Session analytics reviewed quarterly

Session security controls only work if their efficacy is monitored. Without quarterly review of session analytics — login frequency, timeout event rates, concurrent session warnings, suspicious activity triggers — patterns that signal active attacks or policy drift go undetected for months. PCI-DSS Req 10.7 requires review of security logs and events on a regular schedule. NIST 800-63B AU-6 mandates log analysis. A spike in timeout events might indicate session hijacking attempts keeping a stolen session alive; a drop in concurrent-session warnings might mean the control stopped firing. Quarterly reviews convert raw session data into actionable security posture assessments.

Create a session analytics endpoint at src/app/api/admin/session-analytics/route.ts and schedule a calendar review quarterly:

export async function GET() {
  const since = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000); // 90 days
  const analytics = await db.sessionEvents.groupBy({
    by: ['event'],
    where: { timestamp: { gte: since } },
    _count: true
  });
  return Response.json(analytics);
}

Track at minimum: login count, logout count, timeout events, extension events, and concurrent-session warnings. Schedule a recurring calendar item every 90 days with a checklist item to pull this endpoint and document findings — the review record itself is the audit artifact PCI-DSS Req 10.7 requires.