Join us in San Francisco for TailscaleUp!Grab your ticket ->

Border0 session logs

Last validated:

Border0 + Tailscale is currently in beta.

Session logs give you full real-time visibility into what's happening in your privileged access environment.

A session represents the network connection between a user and a socket. For example, a user sending a request to a database creates a session. Each session contains rich contextual data, answering security and audit questions about the following.

  • Who: The single sign-on Tailscale identity of the user or tagged device.
  • What: The resource in your Tailscale network (known as a tailnet) that was accessed. This could be an SSH connection to a server, a database, or other service on your network. The available resources are known as sockets.
  • Where: The geographic location (city and country) and originating IP address of the user or tagged device.
  • When: The date and time of the session.
  • What happened: A session recording. Depending on the context, this could be a capture of SSH commands, database queries, HTTP session replays, or Kubernetes API requests.

This session data provides administrators with full context behind who did what and when for each connection, beyond only IP addresses and ports.

Session recording is currently supported for the following resource types:

  • SSH, including SSH sessions for:
    • Docker
    • AWS Systems Manager (SSM)
    • Amazon Elastic Compute Cloud (EC2)
    • Amazon Elastic Container Service (ECS)
  • Kubernetes
  • Databases
  • HTTP

Examine session data

As an administrator, you can access session data from the Session page of the Border0 admin portal.

  1. Open the Sessions page.
  2. (Optional) Use the Sessions page filters to find a session, such as for a specific socket or user.
  3. Select a session.

Each session entry provides an overview of who accessed what resources when. Once you select a session, you can get more details and context specific for the type of socket accessed. For example, a database session entry would show details for who accessed, or tried to access, the database, at what time, from which device and IP address, whether access was granted, and any queries that were performed.

Replay a session recording

If session recording is enabled for a socket, you can replay the recording for a session. Depending on the recording type, the Sessions page presents different tabs:

  • Video Replay: Displays a movie-like replay of the session, capturing all user actions.
  • Text Replay: Provides a text output of the session, ideal for uploading to a security information and event management (SIEM) system or conducting log analysis.
  • Events: Displays additional session metadata, including denied access attempts and details on the client software used during the session.

Select a tab as needed to replay a recording or examine any events. These tabs offer multiple perspectives on session activity, providing information useful for auditing, compliance, and security investigations.