> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference.md).

# Session Audit Reference

Explore session metadata and raw session data generated by Session Audit

Session Audit captures and stores data on audited SSH, Kubernetes, and RDP sessions. You can use this data for security investigations, compliance evidence, and operational auditing.

Session Audit generates two types of data.

<table><thead><tr><th width="201.62109375">Data type</th><th width="289.265625">Description</th><th>Storage location</th></tr></thead><tbody><tr><td><strong>Session metadata</strong></td><td>Information about the session, including the user, resource, protocol, timestamps, permissions, and status.</td><td>Apono</td></tr><tr><td><strong>Raw session data</strong></td><td>Detailed activity captured during the session. The available data depends on the protocol being audited.</td><td>Customer-managed Amazon S3 bucket</td></tr></tbody></table>

***

### Available protocol data

Session Audit captures different data depending on the protocol.

<table><thead><tr><th width="182.94921875">Protocol</th><th width="210.53125">Supported integrations</th><th>Captured data</th></tr></thead><tbody><tr><td><strong>SSH</strong></td><td><ul><li><strong>SSH</strong></li><li><strong>AWS EC2 SSH</strong></li></ul></td><td><ul><li>Commands</li><li>Command output</li><li>Session lifecycle events</li><li>Permission elevation events</li><li>Session context information</li></ul></td></tr><tr><td><strong>Kubernetes</strong></td><td><ul><li><strong>Kubernetes</strong></li></ul></td><td><ul><li>Kubernetes API calls</li><li>Request bodies for supported operations</li><li>Permission elevation events</li><li>(Coming soon) Port-forward metadata</li><li>(Coming soon) Kubectl session</li></ul></td></tr><tr><td><strong>RDP</strong></td><td><ul><li>RDP</li></ul></td><td><ul><li>Video recording of the RDP session</li></ul></td></tr></tbody></table>

***

{% hint style="info" %} <mark style="color:$primary;">**RDP session recordings**</mark>

When Session Audit is enabled, RDP sessions are recorded automatically and uploaded to the customer-managed Amazon S3 bucket. Recordings are split into multiple video files when session duration or file size thresholds are reached.
{% endhint %}

### Protocol references

Learn more about structured data captured for SSH and Kubernetes:

* [SSH Session Audit Data Reference](/docs/audits-and-reports/session-audit/session-audit-reference/ssh-session-audit-data-reference.md)
* [Kubernetes Session Audit Data Reference](/docs/audits-and-reports/session-audit/session-audit-reference/kubernetes-session-audit-data-reference.md)

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.