Recording and auditing

Every privileged session that goes through the broker is logged, and terminal and desktop sessions are recorded from start to finish. This page explains what evidence remains and how it is used for live supervision and for auditing.

What is recorded

• Terminal and desktop sessions, in full: the SSH and kubectl exec terminal, and the RDP and VNC screen.
• Who and from where: the person, the account they signed in with, the address they connected from and, if the connection was held, what it was waiting for.
• What was run: processes and sudo commands, together with the decisions made during the session.

Everything appears in a single timeline next to the recording. An example of what it contains:

Time	Event	Detail
10:02	Connection	The broker logs the person, the account and the address
10:05	Process started	psql, detected by the machine’s agent
10:33	sudo allowed	apt install, approved by a person
10:41	sudo rejected	su, rejected by a control policy rule
10:44	Session closed	The recording is saved and the password is changed

Processes and sudo commands appear when you install the agent on the machines. For databases and web applications, the broker logs the connection but does not record its content.

Live supervision

PAM > Sessions shows who is inside, on which machine, from where and since when. A session in progress can be watched as it happens and ended instantly. See Sessions and recordings.

Evidence for audits

The recording and its timeline are the evidence of the access: no screenshots are needed. Ironchip also keeps:

Record	Where to find it
Requests and their status	PAM > Approvals (pending) and PAM > My access (your own)
Recordings and their timeline	PAM > Recordings
Passwords handed over (checkout and break-glass)	PAM > Checkouts
Team password reveals	Options > Record on each password in PAM > Passwords
Each workload’s requests for secrets	The workload’s Activity tab in PAM > Secrets > Workloads

They help answer what regulations such as ENS, NIS2 or DORA ask about who accessed, when, with what authorization and what they did. To send the platform’s events to your SIEM, see SIEM integration.

More information

• Approval: how each access is decided.
• Credential vault: what is recorded about each credential.
• Connect to a resource: the session as seen by the person connecting.