Advanced Reporting and Alerts

Keeper's Advanced Reporting and Alerts module provides event logging and log event tracking for over 75 event types, ability to send event-based alerts and integrates into 3rd party SIEM solutions.

Reporting Interface

Reporting & Alerts dashboard provides an overview of the top 5 events, two built-in reports and your custom reports. The "Recent Activity" report is a built-in report that provides basic event tracking for the last 1,000 events across 16 event types. Customers can upgrade to the Advanced Reporting and Alerts module to track over 75 event types and generate custom reports and alert notifications.

The "Recent Activity" and "All Security Events" reports are provided in all Keeper Business and Enterprise subscriptions. Custom reporting and alerts is a feature of the Advanced Reporting and Alerts Module (ARAM). To take advantage of this capability, please contact your Keeper Security account manager or upgrade your subscription through the Secure Add Ons interface of the Admin Console.

Additionally, a user status report is available via the dashboard. See the Dashboard section in this guide.

You can create your own reports by clicking "Add Custom Report".

Preview the results by clicking "Apply", and if you want to use the report in the future, click the "Save" button. You can export the events as a file in JSON, CSV or SysLog formats.

New events generated by Keeper vault devices can take up to 10 minutes to appear in the reporting module.

Timeline Chart

The Timeline Chart provides a chart of events over a 24-hour, 7-day and 30-day period. Clicking on any event row will open a report containing all events from the time period.

Alerts

The Alert module allows you to create event-based triggers that will generate either email or SMS-based alerts.

New alerts are created similarly to new reports, by clicking "Add Alert" and specifying a name and a filter criteria. You can add one or more recipients using email address, phone number (for SMS) or both. Recipients don't have to be a part of your enterprise and any email address or phone number can be provided. The first recipient is a predefined one - it is the user who generated the event. It is "off" by default, you need to toggle the switch to enable sending the alerts (email only) to the originator.

Specifying a broad event and attribute filter could generate a lot of alerts. Adjust alert frequency and set narrow event types and filters to reduce alert noise.

To prevent the recipients from receiving too many emails or SMS, alerts can be throttled. One way to throttle is to specify Alert Frequency. For example, if you set the frequency to "Once Per Time Period" with a period of 1 hour than all events matching the alert filter will still trigger the alert "occurrence" but the message will be sent only if 1 hour passed since the time of the previous message. Another way to throttle the alert is to put it on pause using the toggle switch. Paused alert will also accumulate "occurrences" without sending the actual messages. When resumed, the very next event matching the alert will trigger sending the message which will contain the number of events that happened while being on pause.

Below is an example of an email alert.

You can view the alert history in the "Alerts Sent" tab, with the ability to drill down to see the individual events:

External Logging

If you are utilizing a 3rd party SIEM solution, the Keeper Admin Console can be configured to automatically feed live event data into external SIEM products. Currently supported systems include Splunk (via HTTP Event Collector), Sumo Logic (via HTTP Logs and metrics Source), AWS S3 Bucket (via bucket name/access credentials) and IBM QRadar (via Syslog push). Only one method of the external sync can be active at a time.

Click on "Setup" to activate the external logging solution.

Firewall Whitelist for External Logging

Event logs are pushed from Keeper's backend logging system through a static set of IP addresses. Please ensure that your SIEM HTTP collector IP/port is open to the below addresses.

US / Global

  • 34.194.242.137

  • 18.235.39.229

EU / Dublin

  • 54.246.149.209

  • 34.250.37.43

After external logging is established, it might be automatically put on pause if the external system becomes unavailable and the number of the events in the queue reaches a threshold of 50. If this happens, you will have to manually resume the external logging after correcting the issue. We recommend setting up an alert for the "Paused Audit log Sync" event so you get notified if the external logging is broken.

External logging is real-time, new events appear almost immediately in the external system. The exception is AWS S3 Bucket, which operates on a time frame you set for writing to the bucket. For example, if you set the time frame to a "day", all events will accumulate until the day has ended (using UTC clock) and then a new file containing all day events will be added to your S3 bucket.

Event Types

Within the Admin Console, the default "Recent Activity" report contains 16 event types. Keeper's Advanced Reporting and Alert module supports over 75 event types.

The events captured by Keeper Enterprise are visible in the dropdown menus for report and alert configuration.

Command-Line SDK and Reporting API

In addition to using the user interface for generating custom reports, Keeper supports a command-line interface (CLI) and Python SDK to programmatically generate reports.

Keeper Commander is an open source tool that provides command-line access and automation / integration capabilities. Download Keeper Commander from:

For example, below is a screenshot of the "audit-report" command usage which can be used to generate custom reports through the CLI:

Keeper Commander also integrates into 3rd party SIEM solutions that operate on-premise. For a comprehensive look at how Keeper Commander can be utilized in your environment, please visit the Keeper Commander SDK on Github. If you require assistance with Keeper Commander, please contact commander@keepersecurity.com.

Event List

A list of all available events captured by the Keeper Advanced Reporting and Alert Module are provided below. The Event Code is utilized in the user interface and within the Keeper Commander CLI command parameters. The Message field is utilized for the Alerting module.

Within each event, there may be additional attributes such as Record UID, Shared Folder UID, Team UID, Username, etc. These attributes will appear within the event description and they are also provided to the 3rd party SIEM provider in the format as specified by the destination.

Event Code

Category

Message

Comments

change_master_password

account

User ${username} changed master password

set_two_factor_off

security

User ${username} set 2FA method OFF

change_security_question

account

User ${username} changed security question

change_email

account

User ${username} changed email to ${to_username}

create_user

security

User ${username} created

delete_user

security

User ${to_username} was deleted by admin ${username}

fast_fill

usage

User ${username} autofilled record UID ${record_uid}

login

login

User ${username} logged in to vault

Optional: "channel"

login_failure

login

User ${username} login failed with code ${result_code}

Optional: "channel"

open_record

usage

User ${username} opened record UID ${record_uid}

Optional: "folder_type", "folder_uid"

record_add

usage

User ${username} added record UID ${record_uid}

Optional: "folder_type", "folder_uid"

record_delete

usage

User ${username} sent record UID ${record_uid} to trash

Optional: "folder_type", "folder_uid"

record_remove

usage

User ${username} removed record UID ${record_uid}

Optional: "folder_type", "folder_uid"

record_update

usage

User ${username} updated record UID ${record_uid}

Optional: "folder_type", "folder_uid"

set_two_factor_on

security

User ${username} set 2FA method ${channel} ON

share

share

User ${username} shared record UID ${record_uid} with ${to_username}

transfer_owner

share

User ${username} transferred ownership of record UID ${record_uid} to user ${to_username}

change_share

share

User ${username} changed share permissions for record UID ${record_uid} to user ${to_username}

This event log changes on record share to user

record share includes permissions to re-share and edit

remove_share

share

User ${username} removed share of record UID ${record_uid} from user ${to_username}

accept_share

share

User ${username} accepted share from user ${to_username}

cancel_share

share

User ${username} canceled share from user ${to_username}

add_security_key

security

User ${username} added security key

delete_security_key

security

User ${username} removed security key

added_folder

usage

User ${username} created ${folder_type} folder UID ${folder_uid}

folder_add_user

share

User ${username} added user ${to_username} to shared folder UID ${shared_folder_uid}

folder_remove_user

share

User ${username} removed user ${to_username} from shared folder UID ${shared_folder_uid}

folder_add_team

share

User ${username} added team UID ${team_uid} to shared folder UID ${shared_folder_uid}

folder_remove_team

share

User ${username} removed team UID ${team_uid} from shared folder UID ${shared_folder_uid}

folder_add_record

share

User ${username} added record ${record_uid} to shared folder UID ${shared_folder_uid}

folder_remove_record

share

User ${username} removed record ${record_uid} from shared folder UID ${shared_folder_uid}

empty_trash

usage

User ${username} purged deleted records

added_shared_folder

share

User ${username} created shared folder UID ${shared_folder_uid}

deleted_shared_folder

share

User ${username} deleted shared folder UID ${shared_folder_uid}

deleted_folder

usage

User ${username} deleted ${folder_type} folder UID ${folder_uid}

folder_change_user

share

User ${username} changed user ${to_username} permissions to shared folder UID ${shared_folder_uid}

folder_change_team

share

User ${username} changed team UID ${team_uid} permissions to shared folder UID ${shared_folder_uid}

folder_change_record

share

User ${username} changed record ${record_uid} permissions to shared folder UID ${shared_folder_uid}

login_console

login

User ${username} logged into Admin Console

expire_password

security

User ${to_username} master password was reset by admin ${username}

send_invitation

security

User ${username} invited ${to_username} to join

vault_transferred

security

User ${from_username} vault was transferred to user ${to_username} by admin ${username}

added_admin_key

security

User ${to_username} was provided admin permissions by admin ${username}

added_to_role

security

User ${to_username} was added to Role ${role_id} by admin ${username}

added_to_team

share

User ${to_username} was added to Team ${team_uid} by admin ${username}

accept_transfer

security

User ${username} accepted account transfer consent

accept_invitation

security

User ${username} accepted invitation

lock_user

security

User ${to_username} was locked by admin ${username}

enable_user

security

User ${to_username} was enabled by admin ${username}

set_custom_header_logo

policy

User ${username} set custom header logo

set_custom_email_logo

policy

User ${username} set custom email logo

set_custom_email_content

policy

User ${username} set custom email content

bridge_activated

policy

User ${username} activated Keeper Bridge on node ${node_id}

sso_activated

policy

User ${username} activated Keeper SSO Connect on node ${node_id}

email_provisioning_activated

policy

User ${username} activated Email auto-provisioning for domain ${email_domain} on node ${node_id}

scim_activated

policy

User ${username} activated SCIM provisioning on node ${node_id}

role_enforcement_changed

policy

User ${username} changed enforcement ${enforcement} to ${value} for role ${role_id}

login_failed_console

security

User ${username} failed login to Admin Console

Optional: "channel"

audit_sync_failed

usage

Audit log sync to ${channel} failed with error ${result_code}

audit_sync_restored

usage

Audit log sync to ${channel} restored

audit_sync_paused

usage

Audit log sync to ${channel} paused

audit_alert_sent

usage

Audit alert "${channel}" was sent to ${value}

Optional: "parent_id"

login_failed_ip_whitelist

security

User ${username} has been blocked from IP ${ip_address}

decline_invitation

security

User ${username} declined invitation

set_2fa_configuration

policy

Set global 2FA configuration ${value} for node ${node}

report_created

policy

Admin ${username} created report ${report_name}

report_modified

policy

Admin ${username} modified report ${report_name}

report_deleted

policy

Admin ${username} deleted report ${report_name}

record_password_change

usage

User ${username} changed password on record UID ${record_uid}

added_identity

usage

User ${username} added an identity

added_payment_card

usage

User ${username} added a payment card

changed_identity

usage

User ${username} changed an identity

changed_payment_card

usage

User ${username} changed a payment card

imported_records

usage

User ${username} imported records from ${file_format} file

N/A for IOS

exported_records

usage

User ${username} exported records to ${file_format} file

N/A for IOS

weak_password

password

User ${username} created a password that is weak

N/A

reused_password

password

User ${username} reused a password

revision_restored

usage

User ${username} restored previous revision of record UID ${record_uid}'

record_restored

usage

User ${username} restored deleted record UID ${record_uid}

high_risk_password_detected

breachwatch

BreachWatch detected a high-risk password for user ${username} record UID ${record_uid}

N/A

high_risk_password_resolved

breachwatch

User ${username} resolved a high-risk password detected by BreachWatch for record UID ${record_uid}

N/A

high_risk_password_ignored

breachwatch

User ${username} ignored a high-risk password detected by BreachWatch for record UID ${record_uid}

N/A

chat_message_sent

chat

User ${username} sent a secure message

chat_message_received

chat

User ${username} received a secure message

chat_message_destruct

chat

User ${username} set a message to self destruct

chat_file_attached

chat

User ${username} sent a file

chat_contact_invited

chat

User ${username} invited ${to_username}

Raw Event Data Examples

Below are examples of 2 events in JSON format that are sent. Note that Record UID is provided with the "record_update" event since it relates to a specific record.

{
"record_uid" : "Uk6qLnfWVxWL9OQlsGdOUw",
"audit_event" : "record_update",
"remote_address" : "155.65.556.130",
"client_version" : "Browser Extensions.12.3.0",
"timestamp" : "2019-02-14T22:41:12.027Z",
"username" : "testing@keepersecurity.com"
}
{
"audit_event" : "login",
"remote_address" : "168.123.45.130",
"client_version" : "Web App.14.2.4",
"timestamp" : "2019-02-14T22:40:08.655Z",
"username" : "demo@keepersecurity.com",
"client_version_new" : true
}

Below is an example of a Syslog-format event that can be exported via Keeper Commander or into the 3rd party SIEM solution.

<110>1 2019-02-14T21:34:47Z 46.45.253.15 Keeper - 1132431639 [Keeper@Commander geo_location="Chicago, IL, US" keeper_version_category="MOBILE" audit_event_type="login_failure" keeper_version="iPhone 14.2.0" result_code="auth_failed" username="testing@keepersecurity.com" node_id="47377784242178"] User testing@keepersecurity.com login failed with code auth_failed

Locating the Record UID and other Identifiers

The event data references several types of UID values such as Record UID, Shared Folder UID and Team UID.

The Record UID and Shared Folder UID can be found either through the Keeper Commander CLI or through the Web Vault user interface.