After a session
Everything a work session does is recorded for review on the session’s detail page. The History tab replays a timeline of the session’s activity, and the Analysis tab adds an AI risk assessment once the session ends.
Timeline (History)
The History tab shows a chronological Timeline of the session’s events—who did what, when, and on which server. Each entry is a recorded action:
| Event | What it records |
|---|---|
| Command | Ran a command |
| Websh | Opened a Websh session |
| Tunnel | Opened a tunnel (port forwarding) |
| FTP | Started an FTP session |
| Upload | Uploaded a file |
| Download | Downloaded a file |
| Sudo | Requested a sudo grant |
| Record | A terminal recording |
Browsing the timeline
- Filter by category: All, Websh, WebFTP, Command, or Sudo.
- Toggle Include terminal records to show or hide terminal recordings in the list.
- Switch on the Density view to see how activity is distributed over the session’s duration.
Event details
Select an event to see its details. Depending on the event type, this can include the Server, User, Duration, Client, Status, Result, file Size, Shell, Elapsed time, Target port, Grant type, Verification status, and the related command or session ID.
Terminal recordings
Websh events can have a linked terminal recording. Recordings are masked to hide sensitive data; expand one to play it back, or use View terminal recording to open the linked record. From the timeline you can also jump straight to the AI analysis with View AI analysis.
AI analysis
The Analysis tab provides an AI review of the session. It becomes available once the session has ended (Completed, Expired, or Revoked); before that, the tab notes that analysis isn’t available yet.
If a session hasn’t been analyzed, click Request analysis. While it runs, the tab shows “AI is analyzing the session…” and updates automatically when it’s done.
A completed analysis shows:
- Risk level — Low risk, Medium risk, High risk, or Critical risk.
- Summary — a plain-language overview of what happened.
- Key metrics — Commands run, Risk factors found, Confidence of the assessment, and whether an Attack chain was Detected or None.
It then breaks the review into three sections:
- Activity — the executed commands and a timeline analysis of how the session unfolded.
- Threat analysis — when anything is found, an attack chain view, threat indicators (Malware tools, Credential access, Network artifacts, Sensitive file access), and a MITRE ATT&CK technique list. If nothing is found, it shows “No threats detected”.
- Response guide — recommended actions and a verification guide. The guide shows whether it’s Safe to proceed, then lists manual checks, each with How to check it and the Expected result.