Remote Access
The Privileged Remote Access (PRA) service levels audit all remote access events and include the following.
-
"Asset of {{Target.Type}} created by {{Actor.Name}}.",
-
"Assets of {{Asset.Type}} queried by {{Actor.Name}}.",
-
"Asset of {{Target.Type}} read by {{Actor.Name}}.",
-
"Asset of {{Target.Type}} removed by {{Actor.Name}}.",
-
"Asset of {{Target.Type}} updated by {{Actor.Name}}.",
-
"Installation script for engine created by user {{Actor.Name}}.",
-
"Upgrade to Platform Engine requested by user {{Actor.Name}} for PRA standalone engine currently deployed on PRA site {{Target.AdditionalAttributes.site_name}} to target site {{AdditionalAttributes.platform_site_name}}",
-
"File {{Target.AdditionalAttributes.path}} downloaded by user {{Actor.Name}}.",
-
"File list retrieved by user {{Actor.Name}}.",
-
"File uploaded to {{Target.AdditionalAttributes.path}} by user {{Actor.Name}}.",
-
"Upload requested for X file(s) by user {{Actor.Name}}.",
-
"Secrets retrieved by user {{Actor.Name}}.",
-
"Clipboard data is copied by user {{Actor.Name}}.",
-
"Clipboard data is sent to target by user {{Actor.Name}}.",
-
"Clipboard data updated by user {{Actor.Name}}.",
-
"Clipboard data viewed by user {{Actor.Name}}.",
-
"Session closed due to error: {{AdditionalAttributes.error}}.",
-
"Session closed by user {{Actor.Name}} from the target.",
-
"Session closed by system after timing out.",
-
"Session closed by user {{Actor.Name}} after disconnection.",
-
"Session closed by user {{Actor.Name}} after disconnection.",
-
"Session terminated from the vault and closed by user {{Actor.Name}}.",
-
"Session for a secret launched by user {{Actor.Name}}.",
-
"Launched by user {{Actor.Name}} with Manual Credentials as {{Target.AdditionalAttributes.user_name}} to {{Target.Host.MachineName}}:{{Target.Host.Network.Port}} at {{Target.AdditionalAttributes.site_name}} using {{Target.AdditionalAttributes.protocol}}.",
-
"Launched by user {{Actor.Name}} from secret {{Target.Name}} ({{Target.Id}}) as {{Target.AdditionalAttributes.user_name}} to {{Target.Host.MachineName}}:{{Target.Host.Network.Port}} at {{Target.AdditionalAttributes.site_name}} using {{Target.AdditionalAttributes.protocol}}.",
-
"Launched by user {{Actor.Name}} with Use My Account to {{Target.Host.MachineName}}:{{Target.Host.Network.Port}} at {{Target.AdditionalAttributes.site_name}} using {{Target.AdditionalAttributes.protocol}}.",
-
"Templates retrieved by query by user {{Actor.Name}}.",
-
"Template deselected by user {{Actor.Name}}.",
-
"Templates selected by user {{Actor.Name}}.",
-
"Vault information updated by user {{Actor.Name}}.",
-
"Vault information viewed by user {{Actor.Name}}."
Deprecated Audit Events
-
"Engine activated by user {{Actor.Name}}.",
-
"Engine created by user {{Actor.Name}}.",
-
"Engines retrieved by user {{Actor.Name}}.",
-
"Engine removed by user {{Actor.Name}}.",
-
"Engine upgraded by user {{Actor.Name}}.",
-
"Site created by user {{Actor.Name}}.",
-
"Sites retrieved by user {{Actor.Name}}.",
-
"Site removed by user {{Actor.Name}}.",
-
"Site updated by user {{Actor.Name}}.",