Session Audit Reference

Explore session metadata and raw session data generated by Session Audit

Session Audit captures and stores data on audited SSH, Kubernetes, and RDP sessions. You can use this data for security investigations, compliance evidence, and operational auditing.

Session Audit generates two types of data.

Data type	Description	Storage location
Session metadata	Information about the session, including the user, resource, protocol, timestamps, permissions, and status.	Apono
Raw session data	Detailed activity captured during the session. The available data depends on the protocol being audited.	Customer-managed Amazon S3 bucket

---

Available protocol data

Session Audit captures different data depending on the protocol.

Protocol	Supported integrations	Captured data
SSH	SSH AWS EC2 SSH	Commands Command output Session lifecycle events Permission elevation events Session context information
Kubernetes	Kubernetes	Kubernetes API calls Request bodies for supported operations Permission elevation events (Coming soon) Port-forward metadata (Coming soon) Kubectl session
RDP	RDP	Video recording of the RDP session

---

RDP session recordings

When Session Audit is enabled, RDP sessions are recorded automatically and uploaded to the customer-managed Amazon S3 bucket. Recordings are split into multiple video files when session duration or file size thresholds are reached.

Protocol references

Learn more about structured data captured for SSH and Kubernetes:

• SSH Session Audit Data Reference

• Kubernetes Session Audit Data Reference