# Recording and auditing

> What is recorded in each privileged session, how to watch it live or end it, and what evidence remains of each access, password handed over and secret read.

URL: https://docs.ironchip.com/en/pam/conceptos/grabacion/

Every privileged session that goes through the broker is logged, and terminal and desktop sessions are recorded from start to finish. This page explains what evidence remains and how it is used for live supervision and for auditing.

## What is recorded

- **Terminal and desktop sessions**, in full: the SSH and `kubectl exec` terminal, and the RDP and VNC screen.
- **Who and from where:** the person, the account they signed in with, the address they connected from and, if the connection was held, what it was waiting for.
- **What was run:** processes and `sudo` commands, together with the decisions made during the session.

Everything appears in a single timeline next to the recording. An example of what it contains:

| Time  | Event           | Detail                                                  |
| ----- | --------------- | ------------------------------------------------------- |
| 10:02 | Connection      | The broker logs the person, the account and the address |
| 10:05 | Process started | `psql`, detected by the machine's agent                 |
| 10:33 | `sudo` allowed  | `apt install`, approved by a person                     |
| 10:41 | `sudo` rejected | `su`, rejected by a control policy rule                 |
| 10:44 | Session closed  | The recording is saved and the password is changed      |

Processes and `sudo` commands appear when you install the [agent on the machines](https://docs.ironchip.com/en/pam/administracion/agente/). For databases and web applications, the broker logs the connection but does not record its content.

## Live supervision

**PAM > Sessions** shows who is inside, on which machine, from where and since when. A session in progress can be watched as it happens and ended instantly. See [Sessions and recordings](https://docs.ironchip.com/en/pam/administracion/sesiones/).

## Evidence for audits

The recording and its timeline are the evidence of the access: no screenshots are needed. Ironchip also keeps:

| Record                                           | Where to find it                                                 |
| ------------------------------------------------ | ---------------------------------------------------------------- |
| Requests and their status                        | **PAM > Approvals** (pending) and **PAM > My access** (your own) |
| Recordings and their timeline                    | **PAM > Recordings**                                             |
| Passwords handed over (checkout and break-glass) | **PAM > Checkouts**                                              |
| Team password reveals                            | **Options > Record** on each password in **PAM > Passwords**     |
| Each workload's requests for secrets             | The workload's **Activity** tab in **PAM > Secrets > Workloads** |

They help answer what regulations such as ENS, NIS2 or DORA ask about who accessed, when, with what authorization and what they did. To send the platform's events to your SIEM, see [SIEM integration](https://docs.ironchip.com/en/identidad/administracion/integracion-siem/).

## More information

- [Approval](https://docs.ironchip.com/en/pam/conceptos/aprobacion/): how each access is decided.
- [Credential vault](https://docs.ironchip.com/en/pam/conceptos/boveda/): what is recorded about each credential.
- [Connect to a resource](https://docs.ironchip.com/en/pam/usuarios/conectarse/): the session as seen by the person connecting.