The events you found in the audit log are the complete record. Each one carries the metadata you mentioned (fingerprint, source IP, timestamps, resource IDs), but we do not record commands run inside a session, filenames accessed, or bytes transferred. An SSH session used for SCP or SFTP looks identical to an interactive shell in the log, so there is no way to tell what the session was used for. The one exception is the dashboard file browser: if it was used, a distinct access event with a read or write scope appears, confirming the file channel was opened (though not which files). There is no deeper log behind what you see on the audit log page, and support does not have access to anything beyond it. On Pro your audit log query window is 30 days, so we would recommend capturing what you need while the events are still visible.