For the complete documentation index, see llms.txt. This page is also available as Markdown.

SSH Session Audit Data Reference

Learn about data captured and stored during audited SSH sessions

SSH Session Audit captures activity performed during SSH sessions and stores the resulting audit records. Raw data is stored in your managed Amazon S3 bucket, and session metadata appears in Apono.


Record structure

Each SSH audit record contains the following fields.

Field
Description

timestamp string

Timestamp when the event occurred, in ISO 8601 format

event_type string

Type of audit event

Possible values:

  • session.start: Session initialization

  • ssh.command.execute: Command executed during the session

  • session.end: Session termination

session_id string

Unique identifier for the session

identity object[]

Information about the user who initiated the session

See: identity[]

target object[]

Information about the target resource

See: target[]

data object[]

Event-specific data

See: data[]

identity[]

Field
Description

email string

User email address

ip string

Source IP address

username string

Username associated with the session

target[]

Field
Description

host string

Target host name

port string

Target port

username string

Username used on the target system

data[]

Field
Description

command string

Command executed by the user

May be included for ssh.command.execute events.

exit_code integer

Exit code returned by the command

May be included for ssh.command.execute events.

stdout string

Command output returned by the target system

May be included for ssh.command.execute events.

termination_reason string

Reason the session ended

May be included for session.end events.


Example record


Limitations

Limitation
Description

Interactive terminal applications

Tools such as screen, tmux, and vim may obscure captured input and output streams.

Unsupported terminal environments

Some terminal clients (such as Warp) may not provide complete session capture.

No session replay

Session playback and video recording are not supported.

No real-time monitoring

Commands cannot be monitored or blocked in real time.

Last updated

Was this helpful?