Audit Report Command
Generate a report of security and user activity events, filtered by event type, user, time period, or specific records, with options for aggregation and grouping.
Audit Report
This command/function helps to display a list of reports with proper message.
DotNet CLI
Command: audit-report --limit 50
It returns a list of reports with created date, username, event type and message.
Parameter:
limit - Limit number of rows.
Examples:
My Vault> audit-report --limit 50PowerCommander
Command: Get-KeeperAuditReport
Alias: kar
It returns a list of reports with created date, username, event type and message.
Parameter:
-Limit - Limit number of rows.
Examples:
PS > Get-KeeperAuditReport -Limit 5
Created Username Event Message
------- -------- ----- -------
24-03-2026 11:02:25 test1@example.com login User a1@gmail.com…
24-03-2026 11:02:25 Exampl1 audit_alert_sent Audit alert "A12" was sent to th…
24-03-2026 11:01:52 user@example.com app_client_access KSM device TestRoyalts has acces…
24-03-2026 11:01:52 Exampl2 audit_alert_sent Audit alert "Jira Alert - Test" …
24-03-2026 11:01:52 Exampl3 audit_alert_sent Audit alert "A12" was sent to th… Python CLI
Example:
My Vault> audit-report --report-type raw
Created Audit Event Type Username IP Address Keeper Version Geo Location Message
------------------------- ------------------ -------------------------------- ------------ ------------------ ---------------- -------------------------------------------------------------------------------------------------------------------------------------
2026-04-27 16:55:05+05:30 login [email protected] 10.5.12.58 Commander 17.2.0 null, null, null User [email protected] logged in to vault (PASS)
2026-04-27 16:54:49+05:30 login [email protected] 10.5.11.246 Commander 17.0.0 null, null, null User [email protected] logged in to vault (PASS)
2026-04-27 16:54:49+05:30 device_approved [email protected] 10.5.11.246 Commander 17.0.0 null, null, null Device Python Keeper API is approved for user [email protected]
2026-04-27 16:53:06+05:30 login [email protected] 10.5.12.58 SupportTool 17.3.0 null, null, null User [email protected] logged in to vault (PASS)Audit Report Pattern Prefixes
This command/function displays a list of reports for matched individual regex patterns.
DotNet CLI
Command: audit-report "regex:login.*"
Parameter:
regex:<pattern> - Individual regex pattern.
exact:<text> - Exact string match.
not:exact:<text> - Negation filtering.
Examples:
PowerCommander
Command: Get-KeeperAuditReport
Alias: kar
Parameter:
regex:<pattern> - Individual regex pattern.
exact:<text> - Exact string match.
not:exact:<text> - Negation filtering.
Examples:
Audit Report Match-all
This command/function displays a list of reports for multiple matched patterns.
DotNet CLI
Command: audit-report "exact:audit_alert_sent" "exact:A12" --match-all
Parameter:
exact:<text> - Exact string match.
match-all - AND logic (all patterns must match).
Examples:
PowerCommander
Command: Get-KeeperAuditReport
Parameter:
exact:<text> - Exact string match.
-MatchAll - AND logic (all patterns must match).
Examples:
Audit Report Report-type
This command/function displays a list of reports for particular report type.
DotNet CLI
Command: audit-report --report-type span --columns username audit_event_type
Parameter:
report-type - Type of report like raw, hour, day, week, month, span, dim .
columns - Column name created, audit_event_type, username, ip_address, keeper_version, message, record_uid .
Examples:
PowerCommander
Command: Get-KeeperAuditReport
Parameter:
-ReportType - Type of report like raw, hour, day, week, month, span, dim .
-Columns - Column name created, audit_event_type, username, ip_address, keeper_version, message, record_uid .
Examples:
Audit Report Aggregate
This command/function displays a list of reports with aggregate columns.
DotNet CLI
Command: audit-report --report-type day --aggregate occurrences
Parameter:
aggregate - Aggregate columns like occurrences, first_created, last_created .
Examples:
PowerCommander
Command: Get-KeeperAuditReport
Parameter:
-Aggregate - Aggregate columns like occurrences, first_created, last_created .
Examples:
Audit Report Filters
This command/function displays a list of reports based on filters.
DotNet CLI
Command: audit-report --report-type day --created today --columns username ip_address --order asc
Parameter:
report-type - Type of report like raw, hour, day, week, month, span, dim .
columns - Column name created, audit_event_type, username, ip_address, keeper_version, message, record_uid .
order - Change the report list order asc or desc .
Filters:
created - Created filter like today, yesterday, last_7_days, last_30_days, month_to_date, last_month, year_to_date, last_year .
event-type - Filter by event-type like login, record_update .
username - Filter by username.
to-username - Filter by event's target.
record-uid - Filter by record.
shared-folder-uid - Filter by shared folder.
ip-address- Filter by IP Address.
Examples:
PowerCommander
Command: Get-KeeperAuditReport
Parameter:
-ReportType - Type of report like raw, hour, day, week, month, span, dim .
-Columns - Column name created, audit_event_type, username, ip_address, keeper_version, message, record_uid .
-Order - Change the report list order asc or desc .
Filters:
-Created - Created filter like today, yesterday, last_7_days, last_30_days, month_to_date, last_month, year_to_date, last_year .
-EventType - Filter by event-type like login, record_update .
-Username - Filter by username.
-ToUsername - Filter by event's target.
-RecordUid - Filter by record.
-SharedFolderUid - Filter by shared folder.
-IpAddress- Filter by IP Address.
-NodeId - Filter with node
Examples:
Audit Report Format
This command/function displays a list of reports output based on format like json, table, csv.
DotNet CLI
Command: audit-report --report-type day --columns username ip_address --format json
Parameter:
report-type - Type of report like raw, hour, day, week, month, span, dim .
columns - Column name created, audit_event_type, username, ip_address, keeper_version, message, record_uid .
format - Output format like json, table, csv.
Examples:
Last updated
Was this helpful?