falco

We don't have detailed docs on our audit logs yet. Here's short description: Teleport's SSH servers capture PTY output and send logs to the audit server alongside with session metadata. Every SSH session has a unique identifier, teleport users participated in this session and captured activity. Sessions (structured events) and audit logs can be stored in various sources, for example recently we've implemented SumoLogic for audit events and S3 for session recordings for some of our customers to upload and store this information. Obviously, you could do various things (especially if you are root) to tamper with this system. For these use cases I would use something like https://github.com/draios/falco to capture all application-level activity.

Somewhat related: https://github.com/draios/falco "Sysdig Falco is a behavioral activity monitor designed to detect anomalous activity in your applications. Powered by sysdig’s system call capture infrastructure, falco lets you continuously monitor and detect container, application, host, and network activity... all in one place, from one source of data, with one set of rules."