> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference/ssh-session-audit-data-reference.md).

# SSH Session Audit Data Reference

SSH Session Audit captures activity performed during SSH sessions and stores the resulting audit records. Raw data is stored in your managed Amazon S3 bucket, and session metadata appears in Apono.

***

### Record structure

Each SSH audit record contains the following fields.

<table><thead><tr><th width="250.36328125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>timestamp</strong> string</td><td>Timestamp when the event occurred, in ISO 8601 format</td></tr><tr><td><strong>event_type</strong> string</td><td><p>Type of audit event</p><p><strong>Possible values</strong>:</p><ul><li><code>session.start</code>: Session initialization</li><li><code>ssh.command.execute</code>: Command executed during the session</li><li><code>session.end</code>: Session termination</li></ul></td></tr><tr><td><strong>session_id</strong> string</td><td>Unique identifier for the session</td></tr><tr><td><strong>identity</strong> object[]</td><td><p>Information about the user who initiated the session</p><p>See: <a href="#identity">identity[]</a></p></td></tr><tr><td><strong>target</strong> object[]</td><td><p>Information about the target resource<br></p><p>See: <a href="#target">target[]</a></p></td></tr><tr><td><strong>data</strong> object[]</td><td><p>Event-specific data</p><p>See: <a href="#data">data[]</a></p></td></tr></tbody></table>

#### identity\[]

<table><thead><tr><th width="249.67578125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>email</strong> string</td><td>User email address</td></tr><tr><td><strong>ip</strong> string</td><td>Source IP address</td></tr><tr><td><strong>username</strong> string</td><td>Username associated with the session</td></tr></tbody></table>

#### target\[]

<table><thead><tr><th width="250.3203125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>host</strong> string</td><td>Target host name</td></tr><tr><td><strong>port</strong> string</td><td>Target port</td></tr><tr><td><strong>username</strong> string</td><td>Username used on the target system</td></tr></tbody></table>

#### data\[]

<table><thead><tr><th width="250.37890625">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>command</strong> string</td><td><p>Command executed by the user</p><p>May be included for <code>ssh.command.execute</code> events.</p></td></tr><tr><td><strong>exit_code</strong> integer</td><td><p>Exit code returned by the command</p><p>May be included for <code>ssh.command.execute</code> events.</p></td></tr><tr><td><strong>stdout</strong> string</td><td><p>Command output returned by the target system</p><p>May be included for <code>ssh.command.execute</code> events.</p></td></tr><tr><td><strong>termination_reason</strong> string</td><td><p>Reason the session ended</p><p>May be included for <code>session.end</code> events.</p></td></tr></tbody></table>

***

### Example record

```
{
  "timestamp": "2026-06-01T07:55:07.272230122Z",
  "event_type": "ssh.command.execute",
  "session_id": "d8ejl9hejon6rvn9a590",
  "identity": {
    "username": "user1",
    "email": "user@example.com",
    "ip": "10.88.1.254"
  },
  "target": {
    "host": "10.88.1.17",
    "port": "22",
    "username": "user1"
  },
  "data": {
    "command": "echo \"Test\"",
    "stdout": "Test",
    "exit_code": 0
  }
}
```

***

### Limitations

<table><thead><tr><th width="250.4296875">Limitation</th><th>Description</th></tr></thead><tbody><tr><td><strong>Interactive terminal applications</strong></td><td>Tools such as <code>screen</code>, <code>tmux</code>, and <code>vim</code> may obscure captured input and output streams.</td></tr><tr><td><strong>Unsupported terminal environments</strong></td><td>Some terminal clients (such as Warp) may not provide complete session capture.</td></tr><tr><td><strong>No session replay</strong></td><td>Session playback and video recording are not supported.</td></tr><tr><td><strong>No real-time monitoring</strong></td><td>Commands cannot be monitored or blocked in real time.</td></tr></tbody></table>

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apono.io/docs/audits-and-reports/session-audit/session-audit-reference/ssh-session-audit-data-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.