Our auditors want evidence of what people actually did during a privileged session, not just that a session happened. For SSH and database sessions, does Infisical capture the commands and queries themselves, and can we review a session while it’s still running? Also curious whether there’s a way to block specific commands outright rather than only recording them after the fact.
Hey, great questions!
Yes to all three. Infisical records the full session. For SSH that’s every command and its output, for databases it’s every query plus a result summary. Recording is always on, so you can give the auditors the real transcript.
You can also open a session while it’s live, see live in the dashboard and terminate it from there if needed.
Re blocking: PAM policies let you define regex rules and matching commands get rejected before they run, but that’s SSH only right now.
Thanks!
Jake