Teleport logging & audit security checks
Audit logs, event retention and incident-response hooks — the evidence you need when something goes wrong, and the controls auditors ask for first.
On Teleport, Black Cat runs 6 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Teleport connector needs.
Checks (6)
severity: critical Session Recording Disabled fix difficulty: easy #
Enable session recording to maintain an audit trail of all interactive sessions
- Export the session recording config with tctl get session_recording_config > src.yaml
- Set mode to node-sync or proxy-sync in the spec
- Apply the updated configuration with tctl create -f src.yaml
- Verify sessions are being recorded by starting a session and checking the audit log
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: medium Session Recording in Async Mode fix difficulty: easy #
Switch from async to sync recording mode to prevent recording loss on node crash
- Export the session recording config with tctl get session_recording_config > src.yaml
- Change mode from node or proxy to node-sync or proxy-sync
- Apply the updated configuration with tctl create -f src.yaml
- Monitor session performance to ensure sync mode does not introduce unacceptable latency
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: medium Session Recording in Proxy Mode fix difficulty: medium #
Switch from proxy-mode recording to node-mode for end-to-end encrypted session recordings
- Export the session recording config with tctl get session_recording_config > src.yaml
- Change mode from proxy or proxy-sync to node-sync
- Apply the updated configuration with tctl create -f src.yaml
- Verify existing sessions are still being recorded after the change
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: high Proxy Host Key Checks Disabled fix difficulty: easy #
Enable proxy host key checks to prevent man-in-the-middle attacks on recorded sessions
- Export the session recording config with tctl get session_recording_config > src.yaml
- Set proxy_checks_host_keys to true in the spec
- Apply the updated configuration with tctl create -f src.yaml
- Verify SSH connections still succeed after enabling host key checks
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: critical Role Disables Session Recording fix difficulty: easy #
Remove the session recording override that disables recording in this role
- Export the role with tctl get role/<name> > role.yaml
- Remove or update the record_session option that sets recording to off
- Apply the updated role with tctl create -f role.yaml
- Verify that sessions for users with this role are being recorded
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: medium Audit Log Using Local Filesystem Storage fix difficulty: hard #
Configure a remote audit log backend such as DynamoDB, Firestore, or S3 to ensure log durability
- Export the cluster audit config with tctl get cluster_audit_config > cac.yaml
- Update the audit_events_uri to point to a supported remote backend (DynamoDB, Firestore, or S3)
- Apply the updated configuration with tctl create -f cac.yaml
- Verify audit events are being written to the remote backend
- Consider setting up a SIEM integration to forward audit events for centralized analysis
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1