> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PAM session recording

> Review what happened during each session on your accounts.

Infisical records what happens in each [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview), whether the user connected in the browser or through the CLI. Use recordings to investigate incidents and to show auditors what was done on an account.

The [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) records the session as the traffic passes through it, encrypts the recording, and uploads it while the session runs. To learn more, see [Architecture](https://infisical.com/docs/documentation/platform/pam/architecture.md#recording).

## What gets recorded

What a recording contains depends on the [account type](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md):

| Account type | What the recording contains |
| - | - |
| PostgreSQL, MySQL, Microsoft SQL Server, Oracle, MongoDB, Redis, Snowflake, ClickHouse | Each query or command, and the database's response |
| SSH | Terminal input and output, commands run without a shell, and SFTP file operations |
| Kubernetes, GCP service account, Azure CLI | Each HTTP request to the provider's API, and its response |
| Windows, Windows AD | A replay of the remote desktop |
| AWS IAM | Nothing, because connections don't go through the Gateway (use [AWS CloudTrail](https://infisical.com/docs/documentation/platform/pam/accounts/aws-iam.md#track-activity-in-aws) instead) |

## View a recording

To view a recording, you need the **Admin** or **Auditor** [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the account or its folder.

**Step 1**

Go to **Privileged Access Management** > **Sessions** and select the session.

**Step 2**

Review the recording:

* For Windows and Windows AD accounts, play the replay on the **Session Recording** tab
* For every other account type, read the entries on the **Session Logs** tab, and search them with the search bar

You can view the recording of an active session while it's still running.

## Mask sensitive values

Under **Session Log Masking**, the account's [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) can mask sensitive values before Infisical stores the recording:

* **Built-in Detection** masks API keys and tokens from known providers, and the account's own credentials
* **Custom patterns** mask any text that matches one of your regular expressions

You can't mask recordings of Windows and Windows AD sessions.

## Where recordings are stored

Each [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) sets where Infisical stores the recordings of the accounts that use it:

* **Internal Database**: Infisical stores recordings in its own database
* **S3 Bucket**: Infisical stores recordings in an S3-compatible bucket that you own

Windows and Windows AD accounts require a bucket. To set one up, see [External storage](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.