Compliance Commands
Keeper Commander compliance reporting commands
Last updated
Was this helpful?
KeeperPAM and Secrets Manager
Keeper Commander compliance reporting commands
Last updated
Was this helpful?
Compliance reports let account administrators adhere to regulations by providing on-demand visibility to access permissions on records and credentials across the enterprise.
Using Commander, compliance reports can be scheduled and automated, and results can be exported to a CSV file or JSON.
For more information about Compliance Reports, see the Compliance Reports documentation:
compliance-report commandThe compliance-report command allows you to run reports just as you would in the Keeper Admin Console. See record permissions by node, user and title, filter by owned or shared records and output results to a file.
The compliance-report command relies on a cache in order to improve performance across multiple report queries.
This means that the first call to compliance-report may take several minutes as the system pulls in the required data.
During this time, Commander will display messaging explaining the current step.
Additionally, a manual rebuild of the cache can be performed with the -r flag. Do this to see recent changes in the compliance data.
compliance-report -r
Conversely, if you would like to circumvent the automatic cache-refresh behavior described above and generate a report based solely on previously cached data (resulting in possibly stale results but nevertheless useful for avoiding the possibly long loading times required to refresh the cache), you can do so with the -nr or --no-rebuild flag. Do this to quickly perform queries on compliance data in cases where you can be fairly confident that the relevant data have not changed significantly since the last command call / cache refresh.
compliance-report -nr
Removing the Cache
The compliance report cache can be removed manually with the --no-cache flag. When run, this completely removes all cached compliance report information from your machine.
compliance-report --no-cache
Alternatively, you can delete the cache file locally on disk from the location where you ran Commander. Delete the file called sox_<ID>.db which contains the encrypted compliance data.
The compliance report can be filtered by Node, User, Job Title and if the record is shared, deleted, or active.
Like many Commander reports, the compliance report results can be saved to a file. To do this use the --output and --format options.
Output
--output [FILE PATH]
Tells Commander to write results to a file at the given location. If no file exists it will be created.
Format
--format [csv, json, table]
Tells Commander the format to write the report results as. The default result is in table format, which displays a formatted table of results. The other options are Comma Separated Values (CSV), JavaScript Object Notation (JSON).
compliance commandIn addition to enabling users in generating custom reports, Commander also provides users the ability to generate specific reports with the compliance command. These specific reports can be generated by invoking the compliance command's supported sub-commands.
The compliance command supports the following sub commands:
Refer to the sub command's section for more information.
Shared folders can be shared to Keeper Teams as well as individuals. The compliance report can display a report of the access that each team has to these shared folders.
To run the Compliance Team Report, use the following command in Commander:
compliance team-report
The report shows each team that has access to a shared folder, and what access it has to that shared folder.
The compliance record-access report displays a list of all records that either a) have been accessed by, or b) are currently accessible to any given user(s), along with other relevant information (e.g., app used, IP address, event timestamp, etc.).
To run the Compliance Record-Access Report and show a user's record-access history, run the following command in Commander:
compliance record-access-report --email user1@company.com
where user1@company.com is the user whose record-access activity we'd like to audit, with the resulting output being something like the following:
Similarly, to show a list of all records that are currently accessible by that same user (i.e., all records currently in the user's vault), run the following command:
compliance record-access-report --report-type=vault --email=user1@company.com
The output of the above command should look similar to the previous example, but will exclude records that are not currently in the user's vault and may include records that have never been accessed by that user.
Additionally, if you would like to run this report for multiple users, you may do so by 1) specifying each username / ID separately, 2) by using the "@all" shorthand to indicate that you would like to run the report for all users or 3) by not providing a user — yet a more concise way to include all users in the report. This is illustrated in the following corresponding examples:
compliance record-access-report -e user1@company.com -e user2@company.com
compliance record-access-report --email @all
compliance record-access-report
The compliance summary report displays aggregate information about records within the enterprise (grouped by record-owner by default for now, but support for grouping by other entities may be added to this feature later)
To run the Compliance Summary Report, run the following command in Commander:
compliance summary-report
or
compliance stats
with the resulting output being something like the following:
Similar to compliance team-report, this command outputs a report detailing the access that all entities (teams as well as individual users) have to all shared folders within the enterprise.
To run the Compliance Shared-Folder Report, run the following command in Commander:
compliance shared-folder-report
or
compliance sfr
with the corresponding output:
or
This report uses the described above.
See the for other reports available in Commander
