teleport

Configure Teleport Auto-Discovery to connect cloud resources to Teleport. Use when the user asks to set up auto-discovery, enroll cloud resources into Teleport, configure the Teleport Discovery Service, or onboard Azure VMs or EC2 instances using Terraform and an OIDC integration. Trigger on phrases like "configure teleport discovery", "set up auto-discovery", "enroll my Azure VMs", "enroll EC2 instances", or "connect my cloud resources to Teleport". Also trigger when the user wants to check the enrollment status or troubleshoot enrollment of cloud resources.

Use when investigating identity or resource activity in a Teleport cluster. Covers `tctl investigate` filter semantics, fast facet-only exploration, custom Lucene query construction, and token-efficient parsing patterns.

Review and investigate Teleport session recordings. Use when the user asks to review or audit recorded sessions, find out what happened in a session, or search sessions by what occurred in them (e.g. "sessions that touched production databases", "who ran sudo on prod"). Covers common security workflows such as SOC risk triage of the riskiest sessions, periodic compliance reviews of production access, threat hunting for techniques (privilege escalation, persistence, data exfiltration, SSH config tampering, secret exposure), and incident-response pivots ("what did this user do on that host"). Also lists recent SSH/db/Kubernetes/desktop recordings, summarizes a session, and downloads or plays one back. Trigger on phrases like "review session recordings", "search session recordings", "what happened in session <id>", "find risky sessions", or any mention of Teleport session recordings or session summaries. Also trigger when following up on a session from a previous command.

Review Teleport access lists that are due for audit. Use when the user asks to review access lists, audit Teleport ACLs, check which access lists need attention, perform periodic access list reviews, recertify access, or manage Teleport access list compliance. Trigger on phrases like "review access lists", "which access lists need review", "audit my ACLs", "recertify access lists", or any mention of Teleport access list reviews. Also trigger when the user follows up on access list findings from a previous command.