Skip to main content
Infisical records what happens in each session, whether the user connected in the browser or through the CLI. Use recordings to investigate incidents and to show auditors what was done on an account. The Gateway records the session as the traffic passes through it, encrypts the recording, and uploads it while the session runs. To learn more, see Architecture.

​
What gets recorded

What a recording contains depends on the account type:

​
View a recording

To view a recording, you need the Admin or Auditor role on the account or its folder.
1
Go to Privileged Access Management > Sessions and select the session.
2
Review the recording:
  • For Windows and Windows AD accounts, play the replay on the Session Recording tab
  • For every other account type, read the entries on the Session Logs tab, and search them with the search bar
You can view the recording of an active session while it’s still running.

​
Mask sensitive values

Under Session Log Masking, the account’s template can mask sensitive values before Infisical stores the recording:
  • Built-in Detection masks API keys and tokens from known providers, and the account’s own credentials
  • Custom patterns mask any text that matches one of your regular expressions
You can’t mask recordings of Windows and Windows AD sessions.

​
Where recordings are stored

Each template sets where Infisical stores the recordings of the accounts that use it:
  • Internal Database: Infisical stores recordings in its own database
  • S3 Bucket: Infisical stores recordings in an S3-compatible bucket that you own
Windows and Windows AD accounts require a bucket. To set one up, see External storage.