After a session
Everything a work session does is recorded for review on the session’s detail page. The History tab replays a timeline of the session’s activity, and the Analysis tab adds an AI risk assessment once the session ends.
Timeline (History)
The History tab shows a chronological Timeline of the session’s events—who did what, when, and on which server. Each entry is a recorded action:
| Event | What it records |
|---|---|
| Command | A command run on a server |
| Web terminal | A web terminal opened in the browser or with the CLI |
| Port forwarding | A port forwarding tunnel |
| Editor | A code editor session |
| File transfer | A file transfer session |
| Upload | A file uploaded to a server |
| Download | A file downloaded from a server |
| Privilege elevation | A request to run a command with sudo |
Browsing the timeline
Filter the timeline by category: All, Web terminal, File transfer, Command, or Privilege elevation.
Long sessions load in pages. If loading stopped partway, a Partial label with Retry appears at the top of the list.
Event details
Select an event to see its details. An event shows the Server it ran on and the account it ran as (Run as) when it has them. The other details depend on the event type:
- Command: Exit code, Verification, Channel (Websh, API token, or Service token), and Shell.
- Web terminal, Port forwarding, Editor, and File transfer: when it was Opened and Closed, and how long it stayed open (Open for). A web terminal and port forwarding also show the Client (web or CLI), and port forwarding shows the Target port.
- Upload and Download: File name, Path, and Size.
- Privilege elevation: Allowed by, whether the grant is One-time, the Approver when a person approved it, and Authorized at and Expires at once the grant is in effect.
Terminal recordings
Select a Web terminal event to play its terminal recording in place. The recording loads when you open the event, so a spinner shows while it is read. Recordings are masked to hide sensitive data.
- If the recording could not be read in full, a Partial label appears; select Retry to read it again.
- A terminal that finished without printing anything shows that there is no recording.
- While a terminal is still open in a live session, its recording keeps up as new output arrives. If it has not printed anything yet, the event shows that there is no recording yet.
Playing a recording is available on a paid plan. On the Free plan, the event shows a notice that terminal recordings start on Essentials, with an action to upgrade, start a trial, or ask a workspace admin, depending on your billing permissions. Commands and the other events are not affected.
From the timeline you can also jump straight to the AI analysis with View AI analysis.
AI analysis
The Analysis tab provides an AI review of the session. It becomes available once the session has ended (Completed, Expired, or Revoked); before that, the tab notes that analysis isn’t available yet.
If a session hasn’t been analyzed, click Request analysis. While it runs, the tab shows “AI is analyzing the session…” and updates automatically when it’s done.
A completed analysis shows:
- Risk level — Low risk, Medium risk, High risk, or Critical risk.
- Summary — a plain-language overview of what happened.
- Key metrics — Commands run, Risk factors found, Confidence of the assessment, and whether an Attack chain was Detected or None.
It then breaks the review into three sections:
- Activity — the executed commands and a timeline analysis of how the session unfolded.
- Threat analysis — when anything is found, an attack chain view, threat indicators (Malware tools, Credential access, Network artifacts, Sensitive file access), and a MITRE ATT&CK technique list. If nothing is found, it shows “No threats detected”.
- Response guide — recommended actions and a verification guide. The guide shows whether it’s Safe to proceed, then lists manual checks, each with How to check it and the Expected result.