> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference/kubernetes-session-audit-data-reference.md).

# Kubernetes Session Audit Data Reference

Kubernetes Session Audit captures activity performed during Kubernetes sessions and stores the resulting audit records. Raw data is stored in your managed Amazon S3 bucket, and session metadata appears in Apono.

***

### Record structure

Each Kubernetes audit record contains the following fields.

{% hint style="warning" %}
**Request body exclusions**

Request bodies are not captured for the following resource types:

* Secrets
* ConfigMaps
  {% endhint %}

<table><thead><tr><th width="250.36328125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>timestamp</strong> string</td><td>Timestamp when the event occurred, in ISO 8601 format</td></tr><tr><td><strong>event_type</strong> string</td><td><p>Type of audit event</p><p><strong>Possible values</strong>:</p><ul><li><code>session.start</code>: Session initialization</li><li><code>kube.request</code>: Kubernetes API request performed during the session</li><li><code>session.end</code>: Session termination</li></ul></td></tr><tr><td><strong>session_id</strong> string</td><td>Unique identifier for the session</td></tr><tr><td><strong>identity</strong> object[]</td><td><p>Information about the user who initiated the session</p><p>See: <a href="#identity">identity[]</a></p></td></tr><tr><td><strong>target</strong> object[]</td><td><p>Information about the target resource<br></p><p>See: <a href="#target">target[]</a></p></td></tr><tr><td><strong>data</strong> object[]</td><td><p>Event-specific data</p><p>See: <a href="#data">data[]</a></p></td></tr></tbody></table>

#### identity\[]

<table><thead><tr><th width="249.67578125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>email</strong> string</td><td>User email address</td></tr><tr><td><strong>ip</strong> string</td><td>Source IP address</td></tr><tr><td><strong>username</strong> string</td><td>Username associated with the session</td></tr></tbody></table>

#### target\[]

<table><thead><tr><th width="250.3203125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>cluster</strong> string</td><td>Target cluster name</td></tr><tr><td><strong>url</strong> string</td><td>Kubernetes API endpoint</td></tr></tbody></table>

#### data\[]

<table><thead><tr><th width="250.37890625">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>event_count</strong> integer</td><td><p>Number of Kubernetes audit events associated with the request</p><p>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>name</strong> string</td><td><p>Kubernetes resource name</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>namespace</strong> string</td><td><p>Kubernetes namespace associated with the request</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>resource</strong> string</td><td><p>Kubernetes resource type associated with the request</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>response_code</strong> integer</td><td>HTTP response code returned by the Kubernetes API<br><br>May be included for <code>kube.request</code> events.</td></tr><tr><td><strong>request_body</strong> object[]</td><td><p>Request payload for supported mutating operations</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>request_uri</strong> string</td><td><p>Kubernetes API path associated with the request</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr><tr><td><strong>termination_reason</strong> string</td><td><p>Reason the session ended</p><p><br>May be included for <code>session.end</code> events.</p></td></tr><tr><td><strong>verb</strong> string</td><td><p>Kubernetes API operation performed</p><p><br>May be included for <code>kube.request</code> events.</p></td></tr></tbody></table>

***

### Example record

```
{
  "timestamp": "2026-06-10T15:52:27.190244734Z",
  "event_type": "kube.request",
  "session_id": "d8kogcvvu6lc50a9i4l0",
  "identity": {
    "username": "user1",
    "email": "user@example.com",
    "ip": "10.88.11.21"
  },
  "target": {
    "url": "https://172.20.0.1:443",
    "cluster": "production-cluster"
  },
  "data": {
    "verb": "get",
    "request_uri": "/api/v1/namespaces/default/pods",
    "namespace": "default",
    "resource": "pods",
    "response_code": 200,
    "event_count": 1
  }
}
```

***

### Limitations

<table><thead><tr><th width="250.4296875">Limitation</th><th>Description</th></tr></thead><tbody><tr><td><strong>Unsupported integrations</strong></td><td>(Coming soon) EKS Organization-managed, EKS Namespace, and EKS Group integrations are not supported.</td></tr><tr><td><strong>GUI-based Kubernetes clients</strong></td><td>Tools such as Lens and k9s may generate background API requests that appear as additional audit events.</td></tr><tr><td><strong>Port-forward traffic</strong></td><td>Tunnel content is not captured.</td></tr><tr><td><strong>No session replay</strong></td><td>Session playback and video recording are not supported.</td></tr><tr><td><strong>No real-time monitoring</strong></td><td>Commands cannot be monitored or blocked in real time.</td></tr></tbody></table>

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference/kubernetes-session-audit-data-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.