---
title: "Session events"
slug: "pam-session-session-events"
updated: 2026-11-06T18:38:27Z
published: 2026-11-06T18:38:27Z
canonical: "docs.senhasegura.io/pam-session-session-events"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Session events

This document provides information about the **Session events** report screen, which displays all the commands executed in a remote session.

## Path to access

1. On Segura™, in the navigation bar, hover over the **Products menu** and select **PAM Core**.
2. In the side menu, select **Audit > Sessions > Session events**.

---

## Search fields

| **Item** | **Type** | **Description** |
| --- | --- | --- |
| **Session ID** | Text field | Filters the events by their unique session identification hash generated by Segura™. **Note***:* this identifier is used internally by the application for session-related operations such as access control, activity tracking, and resource management. Each time a session is started, a new hash is generated for that specific session. |
| **Date/Time** | Date picker | Filters the events by the period in which they were held. |
| **Event** | Dropdown menu | Filters the events by the type of event executed during the session. **Note**: the types of events are listed in **Possible event types** below. |
| **Note** | Text field | Filters the events by the note message. |
| **Segura user** | Text field | Filters the events by the Segura™ user who executed the commands. |
| **Origin IP** | Text field | Filters the events by the IP origin address. |
| **Host** | Text field | Filters the events by the session host. |
| **Remote user** | Text field | Filters the events by the remote user’s username. |

**Possible event types:**

- Files changed.
- Files purged.
- Created.
- Drop session.
- Exported Details.
- Video Download.
- Video Emission.
- Blocked Event.
- Observed Event.
- Prohibited Event.
- Terminated.
- Started.
- Interactivity blocked.
- Interactivity blocked (attempted).
- Interactivity unlocked.
- Interactivity unlocked (attempted).
- Live Stream.
- Log viewer.
- Session Play.
- File transfer.
- Access denied.

The **Access denied** event records a refused session request. The event details include the reason for the refusal.

## Report fields

- **ID:** the sequential number that identifies the order of executed commands.
- **Session ID.**
- **Date/Time.**
- **Event.**
- **Note**
- **Origin IP.**
- **Protocol:** identification of which protocol was used during the execution of the session.
- **Host.**
- **Remote user.**
- **Session start.**
- **Session end.**

**Info**

By default, the report displays 30 records per screen. To go to the next screen, click the forward buttons at the end of the report.