Session recordings
VaultPAM records all privileged sessions by default. Recordings are stored encrypted and can be searched, played back, or shared for audit purposes.
Where to find recordings
- Go to Recordings in the VaultPAM console sidebar.
- The recordings list shows all sessions you have permission to view.
- Use the search bar to filter by user, resource, date range, or session duration.
Search and filter options
| Filter | Description |
|---|---|
| User | Filter by the operator who launched the session |
| Resource | Filter by the target resource (hostname or resource name) |
| Safe | Filter by the Safe the session was launched from |
| Date range | Show sessions between two dates |
| Duration | Show sessions longer or shorter than a threshold |
| Status | Filter by completed, in-progress, or error sessions |
Playing back a recording
- Find the session in the recordings list.
- Click the session row to open the recording detail view.
- Click Play to start playback.
- Use the timeline scrubber to jump to a specific point in the session.
- Use the transcript panel (if available) to search for specific commands typed during the session.
Success state: The recording plays back in your browser. You can see all screen activity from the session.
Sharing a recording
To share a recording with an auditor or colleague, see Share a recording for the step-by-step procedure.
Retention policy
By default, session recordings are retained for 30 days from the session end date.
Retention can be configured at the organisation level:
- Go to Organisation settings > Recording retention.
- Set the retention period (minimum 7 days; maximum 365 days, subject to your plan).
- Save the setting.
Recordings that exceed the retention period are permanently deleted. Export recordings to your own storage before expiry if longer retention is required.