diff --git a/web/packages/teleport/src/services/audit/makeEvent.ts b/web/packages/teleport/src/services/audit/makeEvent.ts index d1ef126aba40e..52a0f5f7b30a8 100644 --- a/web/packages/teleport/src/services/audit/makeEvent.ts +++ b/web/packages/teleport/src/services/audit/makeEvent.ts @@ -505,7 +505,20 @@ export const formatters: Formatters = { [eventCodes.SESSION_START]: { type: 'session.start', desc: 'Session Started', - format: ({ user, sid }) => `User [${user}] has started a session [${sid}]`, + format: event => { + const user = event.user || ''; + + if (event.proto === 'kube') { + if (!event.kubernetes_cluster) { + return `User [${user}] has started a Kubernetes session [${event.sid}]`; + } + return `User [${user}] has started a session [${event.sid}] on Kubernetes cluster [${event.kubernetes_cluster}]`; + } + + const node = + event.server_hostname || event.server_addr || event.server_id; + return `User [${user}] has started a session [${event.sid}] on node [${node}] `; + }, }, [eventCodes.SESSION_UPLOAD]: { type: 'session.upload', diff --git a/web/packages/teleport/src/services/audit/types.ts b/web/packages/teleport/src/services/audit/types.ts index fbcbf635b2bd9..4d0a7a109ea71 100644 --- a/web/packages/teleport/src/services/audit/types.ts +++ b/web/packages/teleport/src/services/audit/types.ts @@ -530,6 +530,11 @@ export type RawEvents = { typeof eventCodes.SESSION_START, { sid: string; + kubernetes_cluster: string; + proto: string; + server_hostname: string; + server_addr: string; + server_id: string; } >; [eventCodes.SESSION_REJECT]: RawEvent<