> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference.md).

# Session Audit Reference

Session Audit captures and stores data on audited SSH and Kubernetes sessions. You can use this data for security investigations, compliance evidence, and operational auditing.

Session Audit generates two types of data.

<table><thead><tr><th width="201.62109375">Data type</th><th width="289.265625">Description</th><th>Storage location</th></tr></thead><tbody><tr><td><strong>Session metadata</strong></td><td>Information about the session, including the user, resource, protocol, timestamps, permissions, and status.</td><td>Apono</td></tr><tr><td><strong>Raw session data</strong></td><td>Detailed activity captured during the session. The available data depends on the protocol being audited.</td><td>Customer-managed Amazon S3 bucket</td></tr></tbody></table>

***

### Available protocol data

Session Audit captures different data depending on the protocol.

<table><thead><tr><th width="182.94921875">Protocol</th><th width="210.53125">Supported integrations</th><th>Captured data</th></tr></thead><tbody><tr><td><strong>SSH</strong></td><td><ul><li><strong>SSH</strong></li><li><strong>AWS EC2 SSH</strong></li></ul></td><td><ul><li>Commands</li><li>Command output</li><li>Session lifecycle events</li><li>Permission elevation events</li><li>Session context information</li></ul></td></tr><tr><td><strong>Kubernetes</strong></td><td><ul><li><strong>Kubernetes</strong></li></ul></td><td><ul><li>Kubernetes API calls</li><li>Request bodies for supported operations</li><li>Permission elevation events</li><li>(Coming soon) Port-forward metadata</li><li>(Coming soon) Kubectl session</li></ul></td></tr></tbody></table>

***

### Protocol references

Learn more about the data captured for each protocol:

* [SSH Session Audit Data Reference](/docs/audits-and-reports/session-audit/session-audit-reference/ssh-session-audit-data-reference.md)
* [Kubernetes Session Audit Data Reference](/docs/audits-and-reports/session-audit/session-audit-reference/kubernetes-session-audit-data-reference.md)

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.