One Identity Safeguard for Privileged Sessions 6.8.1 - Administration Guide

Using the Search interface

This section provides an overview on how to use the Search interface. It describes how you can access the Search interface, lists the steps to take to search effectively, view the details of a connection, replay the audit trails, or export the search results as a comma-separated text file.

1. To access the Search interface, navigate to Search.

   Sessions are displayed sorted by date. For ongoing sessions, the Search interface is updated in real-time to always show the most up-to-date information.

   You can view sessions in a card, table or flow view. Click for more details and select from the list.

2. Specify a date and time range to restrict your search criteria as described in Specifying time ranges.

3. Filter connections as described in Using search queries.

4. Search the contents of audit trails as described in Searching in the contents of audit trails.

5. View connection details as described in Viewing session details.

6. Download and replay audit trails as described in Replaying audit trails in your browser.

7. To export the search results as a comma-separated text file, click for more details and select Export CSV. Note that if your search returns more than 10.000 results, only the first 10.000 rows are exported. If you want to see all results, refine your search.

   To customize which fields are exported, click for more details and select Export CSV ....

   

Card view

You can view sessions in a card, table or flow view. Click for more details and select from the list.

In card view, you can add additional search fields to the Search interface. For more information, see Adding custom fields to the card view.

Figure 241: Search — Card view

Adding custom fields to the card view

In card view, you can add additional search fields to the Search interface. This allows quick visualization of your preferred fields from the main page of the Search interface for each session.

Adding custom fields to the card view

1. Click for more details and select Customize Card Fields from the list.

   Figure 242: Search — Customize Card Fields

   

2. Select fields from Collapsed top and Collapsed bottom and the fields will be added as separate fields to the collapsed view of each session.

   The fields you select from Expanded top and Expanded bottom will be added to the expanded view of each session as shown in the figure below.

   Figure 243: Search — Preview

   

   NOTE: Some fields may not be available for every session. When the field is not available, for example, if you have data recorded by SPP, the field will be empty.

Table view

You can view sessions in a card, table or flow view. Click for more details and select from the list.

Figure 244: Search — Table view