What Session Recording Actually Captures
Video, text and structured commands are three different capabilities with different costs and different usefulness. Which one answers which question.
Explainer
Session recording is bought as one thing and delivered as several. What is captured determines what questions it can answer.
Video capture
A visual recording of the session, frame by frame or as a rendered stream.
Captures everything visible, including graphical tools and applications with no command line.
Cannot be searched without additional processing.
Large, which drives the storage cost and the retention decision.
Useful for: demonstrating what happened, graphical administration, investigations where the question is open-ended.
Weak for: finding a specific command across thousands of sessions.
Text and command capture
The commands issued and the output returned, as text.
Searchable, which is the decisive advantage.
Small, by comparison, so retention is affordable.
Structured enough to alert on, which enables real-time controls.
Useful for: search, alerting, review at scale, compliance evidence.
Weak for: graphical sessions, and anything happening inside an application rather than at a shell.
Metadata only
Who connected to what, when, from where, for how long.
Cheap and always worth having, even where full recording is not deployed.
Answers the most common question, which is whether a person accessed a system at a time.
Insufficient for anything about what was done.
What to deploy where
Metadata everywhere, as a baseline.
Command capture on everything with a shell, because it is cheap and searchable.
Video on graphical sessions and on the highest tiers.
Both on tier zero, where the cost is justified by the population being small.
Matching capture to tier is what makes recording affordable across a large estate.
What recording does not capture
Worth being explicit, because deployments overstate coverage.
Actions taken through an API rather than an interactive session. In cloud estates this is most administrative activity, and the platform audit log is the record instead.
Anything done outside the brokered path, which is why enforcing the path matters more than the recording quality.
Actions by an attacker who compromised the endpoint rather than the session, which are recorded as though performed by the legitimate administrator.
Encrypted content within the session, in some capture models.
Intent. A recording shows what was typed, not why.
The integrity requirement
For the recording to be evidence rather than a log.
Stored where the recorded person cannot alter it, which excludes the system being administered.
Written continuously, not at session end, so that terminating a session does not discard the record.
Tamper-evident, with hashing or signing.
Access to recordings controlled and itself audited, since recordings contain credentials and sensitive data.
Alert on recording failure, because a broker that silently stops recording produces sessions everyone believes are covered.
The honest positioning
Recording is a detective and evidentiary control, not a preventive one.
It does not stop anything. It answers questions afterwards, deters when people know it exists, and produces evidence.
Deployments justified as preventing insider misuse are oversold, and the overselling is what leads to recording being deployed without any review process — which is the subject of a later note.
Matching capture to tier
Recording everything at maximum fidelity is the default configuration and rarely the right one.
Metadata universally: who, what, when, from where. Cheap and answers the most common question.
Command capture wherever a shell exists. Small, searchable, and it enables alerting.
Video on graphical sessions, which is where nothing else works.
Both on tier zero, where the population is small enough that cost is not the constraint.
Document the matrix so that coverage claims are specific about what was captured rather than merely that recording was enabled.
Verifying it actually recorded
Silent recording failure is common and is only found by looking for it.
Establish a known session and do known things.
Retrieve the recording and check it captured what you expect.
Check the fidelity matches the configuration you believe is in place.
Induce a failure in a test environment and confirm the alert fires.
Retrieve something near the end of the retention window, which tests the archive rather than the recent cache.
Quarterly, because configuration drifts and storage fills.