Use the query builder in the Activity Center to add and remove data from your activity audit log report to get the information you need.
By default, an activity audit log report includes all activity occurring within the last 24 hours. However, using the query tiles provided you can specify search criteria to retrieve specific information from the activity audit log. The search criteria available includes:
To apply search criteria to the audit log
Activity Category and Time frame are required to generate a report. Other search criteria is optionally and allows you to narrow the report to exact parameters provided
I would like to see defaults to All Activity. Click the tile to limit the report to a particular type of activity and select the activity category to be included in the report.
Occurring within the defaults to Last 24 Hours. To specify a different time frame, click the tile and select the time frame to be included in the report. If using the Custom option, specify the custom date and time range.
To search session activity for a specific keyword or value.
In the Enter a Search Value dialog, enter the keyword or value (e.g., regedit) and click OK.
An additional tile (that includes) appears listing the keyword or value specified. If you later change the activity category, the keyword tile will be dimmed indicating it will not be included in the query.
To remove or edit your selections, use the icons in the upper right corner of a query tile:
Clear: Resets the value back to the default. Clear is only available for Activity category and Time frame.
Edit: Displays the corresponding dialog allowing you to modify your selection. You can also click a query tile to edit your selection.
You can save the current search criteria defined to be used at a later time to generate an activity audit log report. You can save the current search criteria from the main Activity Center view (query builder page) or from the results view.
To save the current search criteria
In the Save Search dialog, enter the following information:
To run a previously saved search, click Open.
Select a search from the list. (The criteria for the selected search is displayed in the right pane.)
Click Open.
The query tiles for the selected search appear in the Activity Center page, where you can then select Run to generate the report.
Editing or deleting a saved search or scheduled report
To generate an activity audit log report
Use the query tiles to specify the content of the report. By default the audit log returns all activity occurring within the last 24 hours. For more information, see Applying search criteria.
Click Run.
The information displayed by default depends on the type of activity report generated. (You can change the columns displayed by selecting the Columns in the upper right of the window.)
For example, the "All Activity" report displays the following information for each event.
Download: Indicates that there is a recorded session available on the archive server. Clicking this button downloads the recording for play back.
|
NOTE: These icons only appear on an "All Activity" or "Session Specific Activity" report. |
Event: The event that occurred. Double-click an event to view or hide event details.
Actions once a report is generated
Once a report is generated, you can use the buttons above the grid as described below.
Custom
Safeguard for Privileged Passwords allows you to schedule the generation of an activity audit log report, which will then be sent via email. The emailed report will be an attachment in the selected .csv or .json format.
To schedule an activity audit log report
Send To: Read-only field displaying the email address of the user currently logged into the Safeguard for Privileged Passwords client. This field is required. If this field is blank, you must set your email address in My Account. For more information, see User information and log out.
To set the schedule, select Run Every to run the job per the run details you enter. (If you deselect Run Every, the schedule details are lost.)
To specify the frequency without start and end times, select from the following controls. If you want to specify start and end times, go to the Use Time Window selection in this section.
Hours: The job runs per the minute setting you specify. For example, if it is 9 am and you want to run the job every 2 hours at 15 past the hour starting at 9:15 am, you would select Runs Every 2 Hours @ 15 minutes after the hour.
Days: The job runs on the frequency of days and the time you enter.
For example, Every 2 Days @ 11:59:00 PM runs the job every other evening just before midnight.
Weeks The job runs per the frequency of weeks at the time and on the days you specify.
For example, Every 2 Weeks @ 5:00:00 AM and Repeat on these days with MON, WED, FRI selected runs the job every other week at 5 am on Monday, Wednesday, and Friday.
Months: The job runs on the frequency of months at the time and on the day you specify.
For example, If you select Every 2 Months @ 1:00:00 AM along with First Saturday of the month, the job will run at 1 am on the first Saturday of every other month.
Select Use Time Windows if you want to enter the Start and End time. You can click add or - delete to control multiple time restrictions. Each time window must be at least one minute apart and not overlap.
For example, for a job to run every ten minutes every day from 10 pm to 2 am you would enter these values:
Enter Every 10 Minutes and Use Time Windows:
Start 12:00:00 AM and End 2:00:00 AM
An entry of Start 10:00:00 PM and End 2:00:00 AM will result in an error that the end time must be after the start time.
If you have selected Days, Weeks, or Months, you will be able to select the number of times for the job to Repeat in the time window you enter.
For a job to run two times every other day at 10:30 am between the hours of 4 am and 8 pm, you would enter these values:
For days, enter Every 2 Days and set the Use Time Windows as Start 4:00:00 AM and End 20:00:00 PM and Repeat 2.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy