This section provides information on how to view encrypted screenshots and on the private keys that are necessary to view them.
Prerequisites
To view encrypted screenshots in the Search interface, you have to upload the necessary private encryption keys to your audit keystore. Only RSA keys (in PEM-encoded X.509 certificates) can be uploaded to the audit keystore.
TIP: One Identity recommends using 2048-bit RSA keys (or stronger).
The private keys are stored locally, in your browser.
NOTE: If you clear your browser’s data, your audit keystore could be deleted. If your audit keystore is deleted, upload your private keys again.
To view encrypted screenshots
-
On the Search page, select an encrypted audit trail.
-
To display the details of a connection, click
. This page is called the details view.
-
To access the list of encrypted screenshots of the selected audit trail, click Events in the details view.
-
Click the screenshot that you want to view.
-
(Optional) Unlock your keystore.
If you have private keys stored in your audit keystore, the Unlock keystore dialog is displayed.
Figure 309: Unlock keystore — Enter your master password
Enter your master password and click Unlock keystore.
The keystore is unlocked and you can use your keys or you can add new keys.
-
(Optional) If there is a missing private key, the Private keys missing dialog opens.
Figure 310: Private keys missing dialog
Click Upload private keys, which takes you to User menu > Audit keystore, where you can add the keys.
-
If you have not added any private keys yet to your audit keystore, see section Adding the first private key to your audit keystore.
-
If you have previously added private keys to your audit keystore, see section Adding further private keys to your audit keystore.
-
-
(Optional) If necessary, add any missing certificates on Basic settings > Local services > Indexer service.
Previously, the audit keystore was used to store certificates as well as private keys. From SPS version 6.10 and onwards, you must upload the certificates to Basic settings > Local services > Indexer service.
For more information on how to add certificates, see Configuring the internal indexer.
Result
Once you add the necessary private keys to your audit keystore, you can view the encrypted screenshots in the Search interface.
.
.
label is displayed in the session details window and you can follow or terminate active sessions.
.
.