SSH Session Audit Data Reference

Learn about data captured and stored during audited SSH sessions

SSH Session Audit captures activity performed during SSH sessions and stores the resulting audit records. Raw data is stored in your managed Amazon S3 bucket, and session metadata appears in Apono.

---

Record structure

Each SSH audit record contains the following fields.

Field	Description
timestamp string	Timestamp when the event occurred, in ISO 8601 format
event_type string	Type of audit event Possible values: session.start: Session initialization ssh.command.execute: Command executed during the session session.end: Session termination
session_id string	Unique identifier for the session
identity object[]	Information about the user who initiated the session See: identity[]
target object[]	Information about the target resource See: target[]
data object[]	Event-specific data See: data[]

identity[]

Field	Description
email string	User email address
ip string	Source IP address
username string	Username associated with the session

target[]

Field	Description
host string	Target host name
port string	Target port
username string	Username used on the target system

data[]

Field	Description
command string	Command executed by the user May be included for ssh.command.execute events.
exit_code integer	Exit code returned by the command May be included for ssh.command.execute events.
stdout string	Command output returned by the target system May be included for ssh.command.execute events.
termination_reason string	Reason the session ended May be included for session.end events.

---

Example record

{
  "timestamp": "2026-06-01T07:55:07.272230122Z",
  "event_type": "ssh.command.execute",
  "session_id": "d8ejl9hejon6rvn9a590",
  "identity": {
    "username": "user1",
    "email": "[e-mail]",
    "ip": "10.88.1.254"
  },
  "target": {
    "host": "10.88.1.17",
    "port": "22",
    "username": "user1"
  },
  "data": {
    "command": "echo \"Test\"",
    "stdout": "Test",
    "exit_code": 0
  }
}

---

Limitations

Limitation	Description
Interactive terminal applications	Tools such as screen, tmux, and vim may obscure captured input and output streams.
Unsupported terminal environments	Some terminal clients (such as Warp) may not provide complete session capture.
No session replay	Session playback and video recording are not supported.
No real-time monitoring	Commands cannot be monitored or blocked in real time.