Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Scheduling an activity audit log report

Safeguard for Privileged Passwords allows you to schedule the generation of an activity audit log report, which will then be sent via email. The emailed report will be an attachment in .json format.

To schedule an activity audit log report

  1. From the Safeguard for Privileged Passwords desktop Home page, select Activity Center.
  2. Specify the search criteria to be used to generate the desired report. For more information, see Applying search criteria.
  3. Click Schedule.
  4. In the Schedule Report dialog, enter the following information:
    1. Name: Enter a name for the report.
    2. Description: Optionally, enter descriptive text for the report.
    3. Send To: Read-only field displaying the email address of the user currently logged into the Safeguard for Privileged Passwords client. This field is required. If this field is blank, you must set your email address in My Accounts. For more information, see User avatar.

    4. Interval: Select the interval, start time, and frequency at which the report is to be generated:

      • Never: Select this option to save the report to run at a later time.
      • Minute: Select the time of day and frequency (minute repeat interval). Best Practice: Do not use the Minute interval.
      • Hour: Select the time of day and frequency (hourly repeat interval).
      • Day: Select the time of day and frequency (daily repeat interval).
      • Week: Select the time of day, frequency (weekly repeat interval), and the days of the week when the report is to be generated.
      • Month: Select the time of day, day of the month or week of the month and day of the week, and frequency (monthly repeat interval).

    5. Time Zone: Select the time zone to be used.
  5. Click Schedule Report.

Editing or deleting a saved search or scheduled report

Click the Open toolbar button to display a list of saved searches and scheduled reports. From this dialog, you can delete or edit a saved search or scheduled report.

  1. From the Safeguard for Privileged Passwords desktop Home page, select Activity Center.
  2. Click Open.

    The Select a Saved Search dialog displays, which contains a list of all saved searches and scheduled reports.

  3. Select a saved search or scheduled report from the list.

    The search criteria defined for the search or report appear in the right pane.

  4. Click one of the toolbar buttons or right-click commands:

    • Delete
    • Edit
    • Edit Schedule
  5. If you selected Delete, click Yes in the confirmation dialog.

    The selected search or schedule will be removed from the list.

  6. Depending on the type of search selected (saved search or scheduled report), the following editing capabilities are available:

    • Edit displays the Save Search dialog, allowing you to modify the name and description for a saved search or schedule. The Edit button is available for a saved search or a scheduled reports with an interval of Never.

    • Edit Schedule displays the Schedule Report dialog, allowing you to modify the schedule settings for a scheduled report. The Edit Schedule button is available for a saved search or a scheduled report. Using the command for a saved search allows you to convert it to a scheduled report.

NOTE: Clicking the Open button at the bottom of the Select a Saved Search dialog, closes the dialog and returns you to the Activity Center view, where the query tiles for the selected search or report appear. You can then select Run to generate the report.

Viewing event details

Additional detailed information is available for some activity events.

To see the details of a specific event

  1. Double-click an event to view additional details.
  2. On Password management events, select Details to see the details of the password change or check tasks.
  3. Double-click to close the event details.

Auditing request workflow

In addition to reviewing activity, you can use the Activity Center to audit the transactions that occurred during the request workflow process, from request to approval to review. For session requests, you can also play back a recorded or live session if Record Sessions is enabled in the entitlement's policy.

If you are an authorized reviewer, you can audit an access request's workflow of a completed request awaiting review from the Home page as well.

To audit request workflow

  1. Open the Activity Center, use the query tiles to specify the content of the report and click Run.

    TIP: You can change the activity category tile to specify that you want to see Access Request Activity, Session Specific Activity events, or both.

  2. Select an access request event and click Workflow to audit the transactions that occurred during the request's workflow from request to approval to review.

    TIP: If you ran an all activity report, use the filter in the Events column to locate the access request activities.
  3. For session requests that have Record Session enabled in the policy, you can play back a recorded or active session:

    1. Locate an access request session event and click Play to launch the Safeguard for Privileged Passwords Desktop Player. The following activities may be available to you:

      • A (green dot) indicates the session is "live". A user with Security Policy administrator permissions can click this icon to follow an active session.
      • If the session recording has been archived and removed from the local Safeguard for Privileged Passwords file system, you will see a Download button instead of a Play button. Click Download to download the recording and then click Play.
    2. Accept the certificate to continue.
    3. Use one of the following methods to play back the session recording:

      • Click Play Channel from the toolbar at the top of the player.
      • Click the thumbnail in the upper right corner of the Information page.
      • Click Play Channel next to a channel in the Channels pane.
  4. For SSH session requests that have the Enable Command Detection option selected in the policy, you can review a list of the commands and programs run during the session.

    For RDP session requests that have the Enable Windows Title Detection option selected in the policy, you can review a list of all the windows opened on the desktop during the privileged session.

    1. Click the Sessions Events link above the transaction grid to view a list of all the session events and recordings available for the selected session.
    2. To see the individual events that occurred during a particular Initialize Session transaction:
      • Click Show Details to display additional information about the Initialize Session event, including Session Events.
      • Click the events link to view the commands and programs run during that particular Initialize Session event

    The Session Events dialog displays listing the events with a time stamp showing when the event occurred as well as in which recording if multiple recordings were created.

Related Documents