Session Recording

Session recording is the capture of what happens inside a privileged session (terminal output, commands, screen and mouse activity, database queries) so that it can be watched live, replayed later and searched during an investigation; in NIST SP 800-53 Rev. 5 it is control AU-14, Session Audit. It is a core feature of PAM and privileged remote access tools.

How it works depends on where the recorder sits. A proxy or bastion in the connection path records every session that passes through it, which is why PAM products broker sessions instead of handing out passwords. An agent on the target host records locally. Teleport's architecture documentation is a useful concrete reference: it captures the full pseudo-terminal output of SSH and kubectl exec sessions, records screen and mouse input but not keystrokes for remote desktop sessions, and offers synchronous modes where a failed recording event ends the session and asynchronous modes that buffer locally and upload later.

It matters because auditors and incident responders ask the same question after a breach: what did the admin account actually do. The limits are real. Recordings are large, so retention and storage cost need a decision up front; recordings contain secrets and personal data, so access to them is itself privileged; and a recording reviewed by nobody is only a log. Pair it with just-in-time access so there are fewer privileged sessions to record in the first place.

See also: PAM, what is PAM, implementing privileged access management, best PAM tools, Teleport, privileged access workstation