mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
catch up with main
This commit is contained in:
Tuan Dang
60
docs/documentation/platform/pam/session-recording.mdx
Normal file
60
docs/documentation/platform/pam/session-recording.mdx
Normal file
@@ -0,0 +1,60 @@
|
||||
---
|
||||
title: "Session Recording"
|
||||
sidebarTitle: "Session Recording"
|
||||
description: "Learn how Infisical records and stores session activity for auditing and monitoring."
|
||||
---
|
||||
|
||||
Infisical's Privileged Access Management (PAM) provides robust session recording capabilities to help you audit and monitor user activity across your infrastructure.
|
||||
|
||||
## How It Works
|
||||
|
||||
When a user initiates a session through the Infisical Gateway, a recording of the session begins. The gateway securely caches all recording data in temporary encrypted files on its local system.
|
||||
|
||||
Once the session concludes, the gateway transmits the complete recording to the Infisical platform for long-term, centralized storage. This asynchronous process ensures that sessions remain operational even if the connection to the Infisical platform is temporarily lost. After the upload is complete, administrators can search and review the session logs in the Infisical UI.
|
||||
|
||||
## What's Captured
|
||||
|
||||
The content captured during a session depends on the type of resource being accessed.
|
||||
|
||||
### Database Sessions
|
||||
|
||||
For database connections, Infisical captures all queries executed and their corresponding responses.
|
||||
|
||||
<Note>
|
||||
Support for additional resource types like SSH and RDP is coming soon.
|
||||
</Note>
|
||||
|
||||
## Viewing Recordings
|
||||
|
||||
To review session recordings:
|
||||
|
||||
1. Navigate to the **PAM Sessions** page in your project.
|
||||
2. Click on a session from the list to view its details.
|
||||
|
||||
|
||||
|
||||
The session details page provides key information, including the complete session logs, connection status, the user who initiated it, and more.
|
||||
|
||||
|
||||
|
||||
### Searching Logs
|
||||
|
||||
You can use the search bar to quickly find relevant information:
|
||||
|
||||
- **On the main Sessions page:** Search across all session logs to locate specific queries or outputs.
|
||||
- **On an individual session page:** Search within that specific session's logs to pinpoint activity.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Are session recordings encrypted?">
|
||||
Yes. All session recordings are encrypted at rest by default, ensuring your audit data is always secure.
|
||||
</Accordion>
|
||||
<Accordion title="Why aren't recordings streamed in real-time?">
|
||||
Currently, Infisical uses an asynchronous approach where the gateway records the entire session locally before uploading it. This design makes your PAM sessions more resilient, as they don't depend on a constant, active connection to the Infisical platform. We may introduce live streaming capabilities in a future release.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -28,46 +28,54 @@ This section walks you through the complete end-to-end process of setting up Azu
|
||||
**Certificate Authority** to access the external CAs page. 
|
||||
</Step>
|
||||
<Step title="Create New Azure ADCS Certificate Service CA">
|
||||
Click **Create CA** and configure: - **Type**: Choose **Azure AD Certificate
|
||||
Service** - **Name**: Friendly name for this CA (e.g., "Production ADCS CA") -
|
||||
**App Connection**: Choose your ADCS connection from the dropdown 
|
||||
</Step>
|
||||
<Step title="Certificate Authority Created">
|
||||
Once created, your Azure ADCS Certificate Authority will appear in the list
|
||||
and be ready for use. 
|
||||
</Step>
|
||||
<Step title="Navigate to Subscribers">
|
||||
Go to **Subscribers** to access the subscribers page. 
|
||||
</Step>
|
||||
<Step title="Create New Subscriber">
|
||||
Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
|
||||
(e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA -
|
||||
**Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
|
||||
Template**: Select from dynamically loaded ADCS templates - **Subject
|
||||
Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
|
||||
Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
|
||||
Fields**: Organization, OU, locality, state, country, email (if required by
|
||||
template) 
|
||||
</Step>
|
||||
<Step title="Subscriber Created">
|
||||
Your subscriber is now created and ready to issue certificates. 
|
||||
</Step>
|
||||
<Step title="Issue New Certificate">
|
||||
Click into your subscriber and click **Order Certificate** to generate a new
|
||||
certificate using your ADCS template. 
|
||||
</Step>
|
||||
<Step title="Certificate Created">
|
||||
Your certificate has been successfully issued by the ADCS server and is ready
|
||||
for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="Create New Azure ADCS Certificate Service CA">
|
||||
Click **Create CA** and configure: - **Type**: Choose **Active Directory
|
||||
Certificate Services (AD CS)** - **Name**: Friendly name for this CA (e.g.,
|
||||
"Production ADCS CA") - **App Connection**: Choose your ADCS connection from
|
||||
the dropdown 
|
||||
</Step>
|
||||
|
||||
<Step title="Certificate Authority Created">
|
||||
Once created, your Azure ADCS Certificate Authority will appear in the list
|
||||
and be ready for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="Navigate to Subscribers">
|
||||
Go to **Subscribers** to access the subscribers page. 
|
||||
</Step>
|
||||
|
||||
<Step title="Create New Subscriber">
|
||||
Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
|
||||
(e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA
|
||||
- **Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
|
||||
Template**: Select from dynamically loaded ADCS templates - **Subject
|
||||
Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
|
||||
Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
|
||||
Fields**: Organization, OU, locality, state, country, email (if required by
|
||||
template) 
|
||||
</Step>
|
||||
|
||||
<Step title="Subscriber Created">
|
||||
Your subscriber is now created and ready to issue certificates. 
|
||||
</Step>
|
||||
|
||||
<Step title="Issue New Certificate">
|
||||
Click into your subscriber and click **Order Certificate** to generate a new
|
||||
certificate using your ADCS template. 
|
||||
</Step>
|
||||
|
||||
<Step title="Certificate Created">
|
||||
Your certificate has been successfully issued by the ADCS server and is
|
||||
ready for use. 
|
||||
</Step>
|
||||
|
||||
<Step title="View Certificate Details">
|
||||
Navigate to **Certificates** to view detailed information about all issued
|
||||
|
||||
Reference in New Issue
Block a user