# Audit Alert Commands

#### Usage <a href="#usage-9" id="usage-9"></a>

```bash
audit-alert command [--options]
```

#### Commands <a href="#commands-5" id="commands-5"></a>

| Command                                     | Description              | Alias |
| ------------------------------------------- | ------------------------ | ----- |
| [`list`](#audit-alert-list)                 | Display alert list       | `l`   |
| [`view`](#audit-alert-view)                 | View alert configuration | `v`   |
| [`history`](#audit-alert-history)           | View alert history       | `h`   |
| [`delete`](#audit-alert-delete)             | Delete audit alert       | `d`   |
| [`add`](#audit-alert-add)                   | Add audit alert          | `a`   |
| [`edit`](#audit-alert-edit)                 | Edit audit alert         | `e`   |
| [`reset-counts`](#audit-alert-reset-counts) | Reset alert counts       |       |
| [`recipient`](#audit-alert-recipient)       | Modify alert recipients  | `r`   |

### Audit Alert list Command <a href="#audit-alert-list" id="audit-alert-list"></a>

Display alert list.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report list`&#x20;

**Example:**

```bash
My Vault> audit-report list
   #  Created                Username                            Event                      Message                                                                                             
----  ---------------------  ----------------------------------  -------------------------  ----------------------------------------------------------------------------------------------------
   1  13/11/2025 9:22:22 AM  user@email.com                      login                      User <user> logged in to vault (PASS)                                      
   2  13/11/2025 9:22:22 AM  Keeper                              audit_alert_sent           Audit alert "ServiceNow Alerts" was sent to <userx>,https://cert860.servi...
```

</details>

<details>

<summary>DotNet SDK</summary>

**Functions:** `GetAvailableEvents`&#x20;

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert list`&#x20;

**Options**

* `-h, --help` show this help message and exit
* `--reload` - Reload alert information
* `--format` - Output format: `json`, `table`, `csv`
* `--output` - path to resulting output file (ignored for "table" format)

**Example:**

```
My Vault> audit-alert list --fromat json
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit Alert view Command <a href="#audit-alert-view" id="audit-alert-view"></a>

View alert configuration.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --event-type="some event type"`&#x20;

**Example:**

```
My Vault> audit-report --event-type="login" --limit=2
  #  Created                Username                         Event  Message                                                       
---  ---------------------  -------------------------------  -----  --------------------------------------------------------------
  1  13/11/2025 9:31:33 AM  user1                             login  User <user1> logged in to vault (PASS)
  2  13/11/2025 9:26:56 AM  user2                             login  User <user2> logged in to vault (PASS)
```

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert view`&#x20;

**Parameter**:

`ALERT` - Alert ID or Name (required)

**Options**

* `-h, --help` show this help message and exit

**Example:**

```
My Vault> audit-alert view <Alert_ID OR Alert_Name>
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert history Command <a href="#audit-alert-history" id="audit-alert-history"></a>

View alert history.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert history`&#x20;

**Parameter**:

`ALERT` - Alert ID or Name (required)

**Options**

* `-h, --help` show this help message and exit
* `--format` - Output format: `json`, `table`, `csv`
* `--output` - Output filename

**Example:**

```
My Vault> audit-alert history <Alert_ID OR Alert_Name>
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert delete Command <a href="#audit-alert-delete" id="audit-alert-delete"></a>

Delete audit alert.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert delete`&#x20;

**Parameter**:

`ALERT` - Alert ID or Name (required)

**Options**

* `-h, --help` show this help message and exit

**Example:**

```
My Vault> audit-alert delete <Alert_ID OR Alert_Name>
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert add Command <a href="#audit-alert-add" id="audit-alert-add"></a>

Add audit alert.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert add`&#x20;

**Options**

* `-h, --help` show this help message and exit
* `--name` - Alert Name (required)
* `--frequency` - Alert Frequency. Format: `[N:]event|minute|hour|day`
* `--audit-event` - Audit Event.
* `--user` - Username. Can be repeated.
* `--record-uid` - Record UID. Can be repeated.
* `--shared-folder-uid` - Shared Folder UID. Can be repeated.
* `--active` - Enable or disable alert: `on` or `off`&#x20;

**Example:**

```
My Vault> audit-alert add --name <name> --frequency <event|minute|hour|day> --audit-event <Event> --record-uid <UID> --user <user> --active on/off
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert edit Command <a href="#audit-alert-edit" id="audit-alert-edit"></a>

Edit audit alert.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert edit`&#x20;

**Parameter:**

`ALERT` - Alert ID or Name (required)

**Options**

* `-h, --help` show this help message and exit
* `--name` - Alert Name
* `--frequency` - Alert Frequency. Format: `[N:]event|minute|hour|day`
* `--audit-event` - Audit Event. Can be repeated.
* `--user` - Username. Can be repeated.
* `--record-uid` - Record UID. Can be repeated.
* `--shared-folder-uid` - Shared Folder UID. Can be repeated.
* `--active` - Enable or disable alert: `on` or `off`&#x20;

**Example:**

```
My Vault> audit-alert edit <Alert_ID> --name <name> --user <user> --active on/off
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert reset-counts Command <a href="#audit-alert-reset-counts" id="audit-alert-reset-counts"></a>

Reset alert counts.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert reset-count`&#x20;

**Parameter**:

`ALERT` - Alert ID or Name (required)

**Option**:

`-h, --help` show this help message and exit

**Example:**

```
My Vault> audit-alert reset-count <Alert_ID>
Alert counts reset to zero
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>

### Audit-Alert recipient Command <a href="#audit-alert-recipient" id="audit-alert-recipient"></a>

Modify alert recipients.

<details>

<summary>DotNet CLI</summary>

**Command:** Coming Soon

</details>

<details>

<summary>DotNet SDK</summary>

**Function**: Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** Coming Soon

</details>

<details>

<summary>Python CLI</summary>

**Command:** `audit-alert recipient <parameter>`&#x20;

**Parameter**:\
`ALERT` Alert ID or Name.

**Options**:\
`-h, --help` show this help message and exit

**Recipient actions:**

* `enable` - Enables recipient
  * `RECIPIENT` - Recipient ID or Name. Use "\*" for "User who generated event"
* `disable` - Disables recipient
  * `RECIPIENT` - Recipient ID or Name. Use "\*" for "User who generated event"
* `delete` - Deletes recipient
  * `RECIPIENT` - Recipient ID or Name
* `add` - Adds recipient
  * `--name` - Recipient name
  * `--email` - Email address
  * `--phone` - Phone number. Format: +1 (555) 555-1234
  * `--webhook` - Webhook URL. See <https://docs.keeper.io/enterprise-guide/webhooks>
  * `--http-body` - Webhook HTTP Body
  * `--cert-errors` - Webhook SSL Certificate errors: `ignore` or `enforce`
  * `--generate-token` - Generate new access token
* `edit` - Edit recipient
  * `RECIPIENT` - Recipient ID or Name (required)
  * `--name` - Recipient name
  * `--email` - Email address
  * `--phone` - Phone number. Format: +1 (555) 555-1234
  * `--webhook` - Webhook URL
  * `--http-body` - Webhook HTTP Body
  * `--cert-errors` - Webhook SSL Certificate errors: `ignore` or `enforce`
  * `--generate-token` - Generate new access token

**Example:**

```
My Vault> audit-alert recipient 1
 Alert ID  1
            Alert name  eMail - changed or alternative created - LAF Consulting
                Status  Enabled

           Recipients:
Send To Originator (*)  False
          Recipient ID  1
                  Name  user
                Status  Enabled
              Email To  user@company.com

          Recipient ID  2
                  Name  user2
                Status  Enabled
              Email To  user2@company.com
```

</details>

<details>

<summary>Python SDK</summary>

**Function**: Coming Soon

</details>