Secret Audit Log

The audit log for a secret can be accessed by clicking the Audit button on the Secret View page or navigating from the User Audit report. The log shows the date, the username, the action, and any other details about the event. Secret auditing provides a detailed view of each change or view on a secret.

Audit logs are visible to anyone with the "list" permission. Thus, anybody with that Delinea permission can view permission changes, users whose permissions were changed, secret dependency information, and the machine.
Audit records are created whenever a user accesses a secret. Repeated view-type actions, such as View and Password Displayed, are audited only once per interval for the same user, no matter how many times the action is carried out within that interval. The default interval is five minutes and is set by the Secret View Interval Minutes and Secret Password Displayed Interval Minutes settings. See Configuring User Experience. Users with Delinea permissions to edit the secret can also choose to include Heartbeat and Remote Password Changing events within the audit.

Secret audits are taken for the following user actions:

  • Adding, updating and removing secret dependencies
  • Check out
  • Editing permissions
  • Forced expiration
  • Hide launcher password changes
  • Password Displayed
  • Set for check-in
  • Update
  • View

A Password Displayed entry is recorded whenever Secret Server returns a secret's password to a caller. This includes a user unmasking or copying the password, and also applications that retrieve the password through the API to connect on the user's behalf, such as Connection Manager and Privileged Remote Access. A Password Displayed entry does not necessarily mean that the password was shown on screen.

The Application column identifies the application that made the request, for example DelineaPlatform for the Delinea Platform interface or RemoteAccessService for Privileged Remote Access session launches. The column is empty when the calling application did not identify itself.

For certain audit items, action notes are added providing additional details. For example, if permissions are edited, an audit record is generated detailing which users or groups gained or lost permissions. Detailed audit records add accountability to sensitive secrets where auditors or administrators need to know exactly what was modified.

The Password Change Log dropdown allows you to include password change log events.

For more information on how the Delinea Platform surfaces audit data, refer to the Delinea Platform documentation.