Kubernetes Session Audit Data Reference

Learn about data captured and stored during audited Kubernetes sessions

Kubernetes Session Audit captures activity performed during Kubernetes sessions and stores the resulting audit records. Raw data is stored in your managed Amazon S3 bucket, and session metadata appears in Apono.

---

Record structure

Each Kubernetes audit record contains the following fields.

Request body exclusions

Request bodies are not captured for the following resource types:

• Secrets

• ConfigMaps

Field	Description
timestamp string	Timestamp when the event occurred, in ISO 8601 format
event_type string	Type of audit event Possible values: session.start: Session initialization kube.request: Kubernetes API request performed during the session session.end: Session termination
session_id string	Unique identifier for the session
identity object[]	Information about the user who initiated the session See: identity[]
target object[]	Information about the target resource See: target[]
data object[]	Event-specific data See: data[]

identity[]

Field	Description
email string	User email address
ip string	Source IP address
username string	Username associated with the session

target[]

Field	Description
cluster string	Target cluster name
url string	Kubernetes API endpoint

data[]

Field	Description
event_count integer	Number of Kubernetes audit events associated with the request May be included for kube.request events.
name string	Kubernetes resource name May be included for kube.request events.
namespace string	Kubernetes namespace associated with the request May be included for kube.request events.
resource string	Kubernetes resource type associated with the request May be included for kube.request events.
response_code integer	HTTP response code returned by the Kubernetes API May be included for kube.request events.
request_body object[]	Request payload for supported mutating operations May be included for kube.request events.
request_uri string	Kubernetes API path associated with the request May be included for kube.request events.
termination_reason string	Reason the session ended May be included for session.end events.
verb string	Kubernetes API operation performed May be included for kube.request events.

---

Example record

{
  "timestamp": "2026-06-10T15:52:27.190244734Z",
  "event_type": "kube.request",
  "session_id": "d8kogcvvu6lc50a9i4l0",
  "identity": {
    "username": "user1",
    "email": "[e-mail]",
    "ip": "10.88.11.21"
  },
  "target": {
    "url": "https://172.20.0.1:443",
    "cluster": "production-cluster"
  },
  "data": {
    "verb": "get",
    "request_uri": "/api/v1/namespaces/default/pods",
    "namespace": "default",
    "resource": "pods",
    "response_code": 200,
    "event_count": 1
  }
}

---

Limitations

Limitation	Description
Unsupported integrations	(Coming soon) EKS Organization-managed, EKS Namespace, and EKS Group integrations are not supported.
GUI-based Kubernetes clients	Tools such as Lens and k9s may generate background API requests that appear as additional audit events.
Port-forward traffic	Tunnel content is not captured.
No session replay	Session playback and video recording are not supported.
No real-time monitoring	Commands cannot be monitored or blocked in real time.