PingOne Privilege

Managing session logs

PingOne Privilege provides comprehensive logging and auditing capabilities that give administrators full visibility into user activity and system events. These logs are essential for security monitoring, compliance, and troubleshooting. Because the Endpoint Controller is bound to the device’s Trusted Platform Module (TPM), every action is cryptographically signed, creating a non-spoofable audit trail of user activity.

If session logging is enabled for your tenant, PingOne Privilege records all Secure Shell (SSH), database, RDP, Kubernetes, ECS, and MCP sessions. These logs provide a detailed audit trail of user activity for compliance and troubleshooting purposes.

Enabling session logs

  1. Click your user profile in the top right corner.

  2. Click Settings.

  3. Click the Edit button.

  4. Under Tenant Information, click the Session Logging and RDP Recording toggles to enable them.

  5. Click the Save Changes button.

Viewing session logs

To view session logs:

  1. In the PingOne Privilege admin console, go to Activity > Session Logs.

  2. Use the available filters to search the logs or narrow the results by a specific time frame, resource, user, or audit status.

  3. Click any log entry in the list to view its details, including a session recording if available.