This section provides information on how to view encrypted screenshots and on the private keys that are necessary to view them.


To view encrypted screenshots in the Search interface, you have to upload the necessary private encryption keys to your audit keystore. Only RSA keys (in PEM-encoded X.509 certificates) can be uploaded to the audit keystore.

One Identity recommends using 2048-bit RSA keys (or stronger).

The private keys are stored locally, in your browser.

NOTE: If you clear your browser’s data, your audit keystore could be deleted. If your audit keystore is deleted, upload your private keys again.

To view encrypted screenshots

  1. On the Search page, select an encrypted audit trail.

  2. To display the details of a connection, click . This page is called the details view.

  3. To access the list of encrypted screenshots of the selected audit trail, click Events in the details view.

  4. Click the screenshot that you want to view.

  5. (Optional) Unlock your keystore.

    If you have private keys stored in your audit keystore, the Unlock keystore dialog is displayed.

    Figure 37: Unlock keystore — Enter your master password

    Enter your master password and click Unlock keystore.

    The keystore is unlocked and you can use your keys or you can add new keys.

  6. (Optional) If there is a missing private key, the Private keys missing dialog opens.

    Figure 38: Private keys missing dialog

    Click Upload private keys, which takes you to User menu > Audit keystore, where you can add the keys.

  7. (Optional) If necessary, add any missing certificates on Basic settings > Local services > Indexer service.

    Previously, the audit keystore was used to store certificates as well as private keys. From SPS version 6.10 and onwards, you must upload the certificates to Basic settings > Local services > Indexer service.

    For more information on how to add certificates, see Configuring the internal indexer.


Once you add the necessary private keys to your audit keystore, you can view the encrypted screenshots in the Search interface.