各リリースノートをご覧になるには、左のナビゲーションをクリックしてください。

管理コンソールのプレビュー

Keeper管理コンソールのプレビューにアクセスするには、以下のリンクを使用してください。

米国: https://keepersecurity.com/console/preview 欧州: https://keepersecurity.eu/console/preview オーストラリア: https://keepersecurity.com.au/console/preview 日本: https://keepersecurity.jp/console/preview カナダ: https://keepersecurity.ca/console/preview 米国公共部門 (GovCloud): プレビューは利用できません

新機能

• Azure Monitor Logs SIEM統合

改善点

• ユーザーステータスの簡素化

• リスク管理ダッシュボード: 無視されたベンチマークの再表示

• 左側のナビゲーションバーの[設定]タブを[カスタムブランド]に変更

• コンプライアンスレポートでユーザー名でも検索可能

• SCIMを使用したユーザー追加時のパフォーマンス改善

• MSPがMC用のカスタムブランド設定可能

バグ修正

• TXTファイルからユーザーをインポートした際にコンソールがフリーズする不具合を修正

• チームが誤って管理者役割に追加される不具合を修正

• 「レポートとアラート」でWebhook設定が保存できない不具合を修正

• リスク管理ダッシュボードのレポートダウンロードに影響を与える不具合を修正

• その他のUIおよびスタイルに関する不具合を修正

新機能

• ユーザーフィードバックを収集するため、管理コンソールにNet Promoter Scoreフォームを追加

改善

• セキュリティ監査画面のデフォルトの並べ替えを変更し、最高スコアが最初に表示されるようにしました。

• セキュリティ監査画面でユーザーのメールアドレスがユーザー名と共に表示されるようになりました。

• デフォルトのKeeper管理者ロールに対する継承を有効にするための操作を明確にしました。

バグ修正

• 請求書を表示する際に白い画面が表示される不具合を修正

• ライセンスの追加用ボタンのクリック領域が大きすぎる不具合を修正

• 試用ユーザーに対して誤ったマスターパスワード強度が表示される不具合を修正

• サブスクリプションマネージャーロールが管理権限を変更できてしまう不具合を修正

• リスク管理ダッシュボードでライセンス数が少ない場合に誤ったテストが表示される不具合を修正

• セキュリティ監査画面でのテーブルヘッダの整列を修正

• 新規ユーザー追加時に必須フィールドが入力されていないときに空のエラーメッセージが表示される不具合を修正

• ユーザーの状態が複数行にわたる場合、ユーザータブの間隔を修正

• ユーザーがいるロールを削除しようとした際に空白のモーダルが表示される不具合を修正

• ARAMアラートの発生回数が誤って表示される不具合を修正

• 同じ名前のチームやロールを複数作成できてしまう不具合を修正

• 無料トライアル中にユーザーの状態が正しく更新されない不具合を修正

すべてのお客様に向けてKeeperPAMの提供を開始しました。新しい特権アクセス管理 (PAM) 機能をご利用になるには、Keeper管理コンソール 17.1以降が必要です。

KeeperPAMの詳細については、以下をご覧ください。

• ウェブサイト

• KeeperPAMの資料

新機能

• パスワードローテーションの最適化

• 接続: ターゲットインフラ内のアセットに即時かつ安全にアクセス

• トンネル

• リモートブラウザ分離

• セッションの録画と再生

• 検出 (現在Keeperコマンダーでのみ対応)

• PAM強制適用ポリシー (RBAC): PAM機能の権限を設定・適用

改善点

• 二要素認証頻度のオプションを追加 (12時間および24時間)

バグ修正

• メールアドレス変更時にアクティブユーザーがログアウトされる不具合を修正

• ARAMタブで特定のシークレットマネージャー用フィールドが表示されない不具合を修正

• デフォルトのパスワードポリシーが8文字ではなく20文字に設定されるよう修正

• Azure Sentinel SIEMとの統合に関する不具合を修正

• その他の軽微な修正および改善

バグ修正と向上点

• EM-5995: セキュリティのアップデート

• EM-6981: 管理対象企業 (MC) をマネージドサービスプロバイダー (MSP) に追加する際にエラーが発生する不具合を修正

• EM-7025: マネージドカンパニー (MC) にユーザーを追加する際にエラーが発生する不具合を修正

• EM-7077: Azure Sentinel SIEM統合の設定を妨げる不具合を修正

• EM-7100: ExabeamとLogRhythmの合併によりExabeam SIEMのタイトルをLogRhythmに変更

特徴

• KeeperPAM: プレビューのページ (英語版のみ。日本語版は現在制作中) をご参照ください。

• EM-6454、EM-6776、EM-6453、EM-6455、EM-6998、EM-7057

• MSP、KeeperPAM SKUがチェックアウト時に利用可能

• コネクションマネージャータブに新しいPAMイベントレポートが追加

• PAMのプロモーション用コンテンツを更新

• コネクションマネージャーのオンプレミスライセンスキーをダウンロードして表示

バグ修正

• EM-5933: 管理コンソールとブラウザ拡張機能で、強制適用ポリシー設定画面のKeeperFill関連の項目名を統一

新しい機能

リスク管理ダッシュボード

Keeperリスク管理ダッシュボードは、Keeper管理コンソールで使用できる強力な機能です。リスク管理ダッシュボードでは、エンドユーザーの導入状況、利用状況、クラウド構成、イベント監視を網羅した包括的なセキュリティ態勢状況が表示されます。この重要なデータにより、リスクに迅速に対処し、コンプライアンスを効果的に確保するのに役立ちます。この新機能について、詳しくは、こちらのページをご参照ください。

バグ修正と改善点

• EM-6779: Keeper Securityのウェブサイトのランディングページから管理コンソールにログインしようとする際に一部のユーザーでログインループに陥る不具合を修正。

• EM-6782: レコード内パスワードのロールポリシーで、ドメインに設定されたパスワード区切り文字の選択を解除できない不具合を修正。

• EM-6790: MSPで基本プランを変更する際にアドオンの選択を更新できないという不具合を修正。

• EM-6624: 新しいロールに管理権限を追加するときに影響する不具合を修正。

• EM-6754: ユーザーがチームタブに移動したときに白い画面が表示される不具合を修正。

• EM-6778: コネクションマネージャタブの誤ったリンクを修正。

• EM-6765: ボルト機能の削除済みレコードの保持ポリシーを編集できない不具合を修正。

• EM-6765: 新規ユーザー招待時に使用できるユーザー名の長さに制限を設けました。

• EM-6806: validate_master_passwordエンドポイントに関するBugcrowdレポートを修正。

• EM-6826: レコードUIDディープリンクをコピーするボタンが、管理コンソール内の対象のテキストフィールドに応じて、値が貼り付けられるようになりました。対象のテキストフィールドでディープリンク全体ではなくUIDのみが期待している場合は、UID値のみが貼り付けられます。

• EM-6758: オムニサーチテキストボックスが不適切にポップアップ表示される不具合を修正。

• EM-6859: ノード選択時に利用可能なロールのみを表示する機能の強化。

• EM-6868: Active DirectoryまたはLDAP Syncプロビジョニング方法で「SSO Connect On-Premをダウンロード」というテキストが誤って表示されていた不具合を修正。

• EM-6866: レポートとアラートの外部ログタブで SIEM パートナーの名前とロゴを最新のものに更新。

• EM-6834: AWS S3 SIEM構成のリージョン選択のサポートを追加。

• EM-6772: SSO IDP名を最新のものに更新。

• EM-6785: ボルト機能のBreachWatchイベントを外部SIEMソリューションに送信するロール ポリシーをデフォルトでオンとなるよう変更。

• EM-6648: オフラインモードのロールポリシーのヒントテキストを更新し、最大オフライン期間が30日であることを含めました。

• EM-6901: 一部のユーザーのブラウザで管理コンソールの古いバージョンがキャッシュされる不具合を修正。

• EM-6899: セキュリティ監査タブで、スコアのリセット要求が処理されている際に視覚的なインジケーターが表示されるようになりました。

• EM-6902: 管理コンソールのブラウザタブを複数開いている場合に安定性に問題が生じる不具合を修正。

• EM-6692: レポートとアラートタブの外部ログ画面でテスト接続リンクが機能しなくなる不具合を修正。

• EM-6897: ARAMイベントの場所の「null」および「unknown」の値を「内部」に置き換えました。

• EM-6907: デバイスがメールから承認されたときに、実際の承認アイコンの代わりに「アイコンが承認されました」というテキストが誤って表示される不具合を修正。

• EM-6870: 非ルート管理者が外部ログを設定しようとすると、エラーメッセージが表示されるようになりました。

• EM-6910: ユーザーが携帯電話でDuo 2FAリクエストを承認すると、ログイン画面にエラーメッセージが表示される不具合を修正。

• KA-6310: BouncyCastle暗号化ライブラリを最近認定された新しい暗号化モジュールに更新しました。

特徴

セキュリティ監査画面の一新

管理コンソールのセキュリティ監査タブが新しい​​デザインに更新され、注意が必要な領域を簡単に特定できるようになりました。

総合セキュリティスコアの計算ロジックは変更されておらず、セキュリティ監査タブの上部に大きく表示されます。スコアの要因となるセキュリティ領域 (強力なレコードパスワード、固有のレコード パスワード、二要素認証の適用状況) は、総合セキュリティスコアの下に個別のカードとして表示されます。カードのスコアが100%の場合 (すべてのレコードに強力なパスワードがあり、使いまわされたパスワードが存在しない、すべてのユーザーで二要素認証が有効になっている)、カードは折りたたまれた状態になります。それ以外の場合は、カードが展開され詳細が表示されます。

すべてのセキュリティエリアが緑

注意が必要なセキュリティ領域

レコード内パスワード強度のカテゴリ

ユーザー別詳細情報の表示画面では、ボルトと同様に4つのレコード内パスワード強度のカテゴリ (弱い、普通、中、強い) が追加されました。リストは、デフォルトではユーザーの全体的なセキュリティ監査スコアに基づいて並べ替えられ、セキュリティ監査スコアが最も低いユーザーが最初に表示されます。この並べ替え順序を逆にしたり、ユーザー名、パスワードの強度、パスワードの使い回し、二要素認証方式に基づいて並べ替えたりすることができます。

さらに、以下のフィールドでリストをフィルタリングできます。

• レコード内パスワードの強度: 強力、普通、やや弱い、弱い

• ユニークなレコード内パスワード: 使い回しまたはユニーク

• 2FA: テキストメッセージ、認証アプリ (TOTP)、スマートウォッチ (KeeperDNA)、セキュリティキー、RSA SecurID、Duo Security、2FAなし

セキュリティ監査スコアの一新

今回のリリースでは、管理者はコンソールからログアウトして再度ログインしなくても、セキュリティスコアを簡単に更新できるようになりました。ユーザー側でボルトにログインして最新のセキュリティスコアを管理コンソールに同期させるのを待たずに済むようになります。ユーザーがボルトにログインした際に、管理者が[スコアの更新]ボタンをクリックするだけで、最新のスコアを管理コンソールに同期できるようになります。

セキュリティ監査スコアのリセット

スコアがユーザーのボルトと同期しなくなった場合、管理者によって簡単にセキュリティスコアをリセットできるようになりました。管理者はセキュリティ監査画面の[スコアのリセット]ボタンを使用して組織全体のスコアをリセットすることも、特定のユーザーのスコアをリセットすることもできます。セキュリティ監査スコアをリセットできるのはルート管理者のみとなります。

セキュリティ監査画面の[スコアをリセット]ボタンをクリックすると、組織全体のスコアがリセットされます。スコアがリセットされると、Keeperのゼロ知識アーキテクチャの制約により、スコアを管理コンソールに同期するには、ユーザーがボルトにログインする必要があります。

また、管理者がユーザーの詳細情報ウィンドウに移動し、[ユーザーアクション]から[セキュリティスコアをリセット]を選択して、個々のユーザーのセキュリティ監査スコアをリセットすることもできます。組織全体のスコアリセットを実行する場合と同様に、スコアがリセットされると、Keeper のゼロ知識アーキテクチャの制約により、スコアを管理コンソールに同期するには、ユーザーがボルトにログインする必要があります。

バグ修正

EM-6734: 大規模なセキュリティ監査データセットでブラウザがクラッシュする不具合を修正。

既知の問題

ブラウザが管理コンソールの更新バージョンを検出しないため、一部のユーザーのセキュリティ監査画面にセキュリティデータが読み込まれません。この問題を解決するには、以下のブラウザ別の手順に従ってサイトデータを消去してみてください。

仕様

EM-6011: パスワード、パスフレーズ、記号のポリシー

ロールポリシーで、新しいパスワード生成ツールとパスフレーズ生成ツールの設定が使用できるようになりました。ユーザーインターフェイスでは、古いパスワード生成ポリシー設定が「記録内パスワード」という新しいセクションに移動されました。

この仕様には、以下のような多くの新機能が含まれています。

• デフォルトのパスワードポリシー

• デフォルトの記号ポリシー

• デフォルトのパスフレーズポリシー

• ドメイン限定のパスワードと記号のポリシー

• ドメイン限定のパスフレーズポリシー

この更新により、ドメイン限定のポリシーが設定されていない限り、サポートされているボルトアプリケーションのパスワード生成ツールには「デフォルト」ポリシーが使用されるようになります。 以前は、ドメインレベルでデフォルトポリシーを適用するには、ワイルドカード (*) を使用する必要がありました。この変更により、ドメインをKeeperの記録に保存しなくともデフォルトポリシーを確立できるようになります。

ボルトユーザーインターフェイス上の新しいパスワードおよびパスフレーズ生成ツールは、Keeperウェブボルト、Keeperデスクトップのバージョン 16.11.0から、全プラットフォームに拡大されます。 ブラウザ拡張機能、iOS、Androidアプリでも、今後のリリースで新しい生成ツールのポリシーに対応する予定です。

EM-6303: 新しいポリシーの「分離ノードの外部で共有可」

EM-6257: SIEM Syslogプッシュ用のカスタムポートを作成できる機能を追加

EM-6088: 新しいARAMイベント「代替マスターパスワードの作成」を追加

向上点

• EM-6420: syslog_app_client_folder_delete と syslog_app_client_folder_update の2つのARAMイベントを表示

• EM-6537: ボルト移管画面にメールアドレスを表示

• EM-6533: プッシュ通知への依存を軽減するために、バックエンドとのDuo API通信の改善を実装

バグ修正

• EM-6318, EM-6275: API ベースのユニットに対してKSM ライセンス情報が適切に表示されない不具合を修正

• EM-6306: 「フォルダからチームを削除」イベントでフォルダUIDではなくチーム名が表示されるなど、UI、ローカリゼーション、視覚に関する不具合を修正

バグ修正

• EM-6470: ロールタブに移動すると、状況によっては空白の画面が表示される不具合を修正

管理コンソール概要

本リリースでは、ビジネスプランおよびエンタープライズプランのバグ修正とUIの改善が含まれます。

新しい仕様

オンボーディング

オンボーディング作業をさらに簡単かつ迅速に行える新しい管理コンソール

UIの改善

以下の箇所でのUIが改善されました。

• ノード

• ユーザー、タブ、表、ドロワー

• ロールのタブ、表、ドロワー

• チームのタブ、表、ドロワー

• 2FAのタブ、表、ドロワー

• プロビジョニングのタブ、表、ドロワー

操作性

以下の様々な操作性の向上

• シングルサインオン設定で利用可能なIDプロバイダを追加

• Cloud SSOページに新しい編集ボタンを設置

• 行内の任意の場所をクリックしてプロビジョニング設定を編集

• ユーザーリストにメールアドレスを表示

• ユーザーリストのメールアドレスの横に新しいコピーボタンを設置

• ユーザー詳細に転送ポリシーの承認ステータスを追加

• ユーザー詳細にに2FAのステータスを追加

• ロールポリシーの編集時に、ロール名を左上隅に表示

• ロールリストでユーザーを英数字順に並べ替え

その他の向上

• SCIMグループからロールへのプレフィックスベースのマッピングを実装

• ロールを複製する機能を追加

• 非アクティブログアウトタイマー設定の一貫性の向上

• ロールの重複を防ぐための強制ポリシーを追加

• セキュリティ キーにPINを必要とする強制ポリシーを追加

バグ修正

• KA-5666: EnterpriseのレベルごとのKeeper Secrets Manager使用量の計算に関する不具合を修正

• EM-5756: 長い名前のオブジェクトが検索結果から除外される不具合を修正

• EM-5802: 期限切れ/非アクティブなライセンスに対するARAMアラートの表示に関する不具合を修正

• EM-5843: 削除されたロールがユーザー詳細ページ内に表示され続ける不具合を修正

• EM-5588: ロール適用を削除した後、リンクされていないデータがデータベースに残る不具合を修正

• EM-5944: 動的データ交換が有効になっている古いバージョンのExcelで、CSVダウンロードがコードインジェクション攻撃を受けやすい不具合を修正

• EM-5257: ユーザーの2FAが無効になっている場合にコンソールに通知が表示されない不具合を修正

• EM-6131: すでに使用されているメールアドレスを持つユーザーを追加しようとしたときに表示されるエラーメッセージに詳細情報を追加

• EM-5782: 間違ったノードで管理者に承認を求めるメッセージが表示される不具合を修正

• EM-6092: 複数のページ結果がある画面にページ番号を追加しました

• EM-6045: 既存のアラートに受信者を追加するときに誤ったナビゲーションが発生する不具合を修正

• EM-6074: 管理者がアクティブなSIEM統合の設定を更新できるようになりました

• EM-6185: 中間者攻撃に対する防御の強化

• EM-6234: 依存関係にあるUI要素を無効にするとともに、依存関係にある強制設定の挙動を変更し、実際に関連の設定が変更されるようになりました

古いリリースノートの内容もまだ利用可能ですが、過去10回分のアップデートより古いものはここに掲載されています。

概要

今回のリリースでは、ビジネスユーザーおよびエンタープライズユーザー向けに「詳細な共有設定の強制」と「唯一の2FA方法としてのセキュリティキー」の2つの機能が実装されます。

詳細な共有設定の強制

• KA-5689: Keeperの詳細な共有設定の強制により、管理者は記録の作成と共有に対する詳細な制限をユーザーロールに適用できるようになります。管理者は、ロール強制ポリシー内の「作成と共有」セクションで設定できます。

詳細な共有設定の強制 (動画)

唯一の2FA方法としてのセキュリティキー

• KA-5628: Keeper管理者がロール強制ポリシー設定を介して唯一の2要素方式としてハードウェアベースのセキュリティキーの使用を強制できるようになりました。さらに、管理者は、FIDO2ユーザー認証のために、キーと組み合わせてPINの入力を要求できるようになりました。FIDO2 セキュリティキーの詳細については、こちらをご参照ください。

唯一の2FA方法としてのセキュリティキー (動画)

セキュリティキーの強制に関する注意点

1. FIDO2セキュリティキーの強制のサポートは、デバイスのOSとファームウェアの機能に応じて異なる場合があります。

2. iOS版KeeperではNFCキーの使用が必要となります。

3. 唯一の要素としてのセキュリティキーを有効にするには、ウェブボルトかKeeper Desktopを使用する必要があります。iOS、Androidでの唯一の要素としてのセキュリティキーの登録については、今後のリリースで対応予定です。

4. iOSアプリ拡張機能 (自動入力機能使用中) など、モバイルアプリケーションの一部コンポーネントでは、ネイティブでNFCハードウェアキーがサポートされていません。KeeperのiOS チームでこの問題の回避策を開発しており、2024年1月末にKeeper iOSバージョン 16.10.10 でリリース予定です。iOSメインアプリとiOS自動入力拡張機能の間のログインセッションを拡張して、再認証の必要性を減らすことで解決します。

5. PIN要件は、デバイスの機能に基づいてサポートされてます。本項目の執筆時点では、モバイル OSでのPIN強制のサポートは制限されています。ユーザーがモバイル端末からKeeperにアクセスしている場合は、PINの強制を推奨しません。

新機能

• KA-4724: SSOクラウド設定画面でのクラウドSSO SAMLパラメータとしてForceAuthnに対応。SAMLリクエストで ForceAuthn="true"が設定されている場合、サービスプロバイダ (Keeper) からアイデンティティプロバイダへ、ユーザーがすでに認証されている場合でも新しい認証済みセッションを強制する必要があることを伝えます。

• EM-4577: Splunk、Syslog、QRadar、 LogRhythmのセットアップで、Unverified Certificates (未確認の証明書) に対応。

• EM-5071: ユーザーが無料の家族向けライセンスを作成できないように制限する「Keeper Family ライセンスへの招待を禁止する」というロール強制ポリシーを追加。

• EM-5850: ブラジルポルトガル語への対応

• EM-5278: エクスポートされたセキュリティ監査レポートに各ユーザーのノードパスを追加

• EM-5926: 2FAの期間に12時間と24時間を追加

• EM-5242: モバイル端末でもMSP およびEnterpriseの無料トライアルサインアップの作成を許可。以前はデスクトップブラウザーに限定されていました。

• EM-5236: 新機能のプロモーション情報を含むログイン画面

バグ修正

• KA-4144: 同期ボタンをクリックしないと記録タイプの変更がコンソールに同期されない不具合を修正

• EM-4750: SSOユーザーが管理コンソールへログインしようとする際にマスター パスワードを要求されることがある不具合を修正

機能改善

• EM-5804: デスクトップアプリケーションからのLastPass共有フォルダのインポートを制限するRESTRICT_IMPORT_SHARED_FOLDERSを実装しました。

不具合修正

• EM-5701: 1,000人以上のユーザーがいる場合、管理コンソールのユーザーステータスレポートで「最終ログイン」データが空でした。

• EM-5770: 理者コンソールにログインしても、保留中のチームユーザーが承認されないことがありました。ユーザーを承認するには、[完全同期]をクリックする必要があります。

• EM-5685: ユーザーリストのページネーションセレクタが画面外に出てしまう。

• EM-5610: コンプライアンス・レポート・セクションで、管理者は "保存 "フィルタ・ボタンを複数回クリックすることができ、クリックするたびにフィルタが作成されます。

• EM-5838: GovCloudリージョンで、Secrets Managerのローテーション ポリシーを有効にすると、白い画面が表示されます。

• さまざまな言語とUIの修正

機能

• EM-5703: リカバリーフレーズの実装 　新しいより安全な24単語の「リカバリーフレーズ」機能でアカウント回復プロセスをアップグレードしました。詳しくはKeeper ブログをご覧ください。

このアップデートにより、アカウント回復を無効にする既存の設定は、リカバリーフレーズメソッドに加えて、従来のセキュリティアンサーにも適用されるようになりました。 以下の点にご注意ください。

• 現在セキュリティ回答を持つユーザーには、セキュリティの質問/回答を自動生成された 24 語のリカバリフレーズに置き換えるよう求めるプロンプトが表示されます。

• このポリシーがすでに無効になっている場合、ユーザーにプロンプトは表示されません。

• リカバリフレーズを制限するようにポリシーを変更すると、すべてのユーザーに即座に反映されます。

不具合修正

• EM-5758: SSOマスターパスワードポリシーの言語と機能が少し更新されました。以前は、SSOマスターパスワードを作成したユーザーは、管理者がポリシーを適用した後でも、このログイン方法を使用できました。現在は、このポリシーが適用されると、ユーザーはログインもマスターパスワードの作成もできなくなります。この情報を反映するために、ユーザーインターフェースの文言が更新されました。

Beta Features

• EM-5586: Password Rotation module for Keeper Secrets Manager and KeeperPAM

Bug Fixes

• EM-5638, EM-5738: Layout and visual issues

• EM-5736: SSO migration status is incorrect if quick sync performed while on Provisioning tab

Improvements

• EM-5767: Set new default PBKDF2 iterations to 1,000,000 rounds

Features

• Share Admin Keeper's Share Admin feature is a role-based permission that gives administrators elevated access rights over your organization's shared folders and shared records. Share Admins have full user and record privileges for any shared record that they have access to. See: https://docs.keeper.io/enterprise-guide/share-admin

Introducing Share Admin​

Bug Fixes

• EM-5569, EM-5581, EM-5557, EM-5587, EM-5590, EM-5608, EM-5602: Multiple layout or visual issues

• EM-5605: Remove "include myself in team" when MSP is logged into MC console and creating a team.

Features

• EM-4860: Role Enforcement: Set Stay Logged In default setting to "On" for new users in this role

• EM-4881: Role Enforcement: Enable "Self Destruct" for users in this role

• EM-5291: Mask prices on enterprise receipts when enterprise licenses sold through a distributor or reseller

Bug Fixes

• EM-5321: SSO migration status shows "complete" immediately after configuration

• EM-5092: ARAM timeline events with low numbers are displayed incorrectly

• EM-4933: Missing descriptive text on "forgot password" screen

• EM-4852: User able to create a role with a blank name

• EM-5287: Persist hover controls on role detail screen

• EM-5268: Display issue with node selector

• EM-5328: Console screen freezes when trying to unlock a locked account

• EM-5342: MSP Console screen goes blank when selecting license allocation history

• EM-5343: Incorrect expiration date on subscription banner

New Features

• Role Enforcement policy for One-Time Share feature. One-Time Share is disabled by default on all existing roles prior to the launch of this feature.

Bug Fixes

• EM-5239: Alerts showing "NaN"

• EM-4906: Commas no nodes are not escaped in export

• Various small bug fixes

Features

• EM-5178: Automated SSO Migration from On-Prem to Cloud

More information about the migration tool can be found here:

https://docs.keeper.io/sso-connect-guide/sso-migration-to-cloud

The Admin Console allows the creation of SSO Connect and SSO Connect Cloud on same node on provisioning screen and will display the status of migration to cloud.

• EM-5159: Redirect method for SSO login

With this change, users who login to the Admin Console with SSO will login with a URL redirect (similar to the Web Vault) instead of a popup window. This change prevents timing-related issues with login.

Bug Fixes

• EM-5007: Changing a user's name is not showing in search results

• EM-5086: Admin Console throws errors when approving SCIM users and teams.

• EM-5222: Show the authentication method used in ARAM login events.

• EM-4895: Users imported through CSV not being assigned to specified role

Features

EM-4704: Keeper Secrets Manager

Keeper Secrets Manager provides your DevOps, IT Security and software development teams with a fully cloud-based, Zero-Knowledge platform for managing all of your infrastructure secrets such as API keys, Database passwords, access keys, certificates and any type of confidential data.

Product Overview

Keeper Secrets Manager | Keeper SecurityKeeper® Password Manager & Digital Vault

Documentation for Secrets Manager

OverviewSecrets Manager

Bug Fixes

• EM-5068: Transfer Account fails with 'authentication tag not found'

• EM-5060: Upgrading to an existing Managed Company to "Plus" plan does not add the add-ons

• EM-5059: Drag and drop a company logo is not working

• EM-4957: When MSP admin creates an alert for a managed company, they cannot select an alert frequency.

• EM-5070: Showing "Unknown login error" when the user's device is locked

• EM-4876: Column names on security audit report are not localized

• EM-4468: Adding a custom email invite with too much text is failing on save

Improvements

• Clarified the meaning of the "Prevent users from creating identity and payments records" setting.

  This setting will only apply to the identity and payments section of the vault. If users still have access to “Address” and “Payment” record types, they will be able to create those records. To disable, navigate to the “Record Types” section of the appropriate role policy.”

• Added Devo as a SIEM provider

New Features

Compliance Reports (General Availability)

Compliance Reports provide on-demand visibility of the access permissions associated with your enterprise records. These reports simplify the compliance auditing process for Sarbanes Oxley (SOX) and other regulations requiring access control monitoring. The user-defined reports can be exported and fed into automated compliance systems or sent directly to external auditors. This is a secure add-on feature to your Keeper license package. (See Admin Console 16.0.0 release notes or "Compliance Reports" section of the Enterprise Guide for more details on the feature.)

Note: Record types will automatically be activated when Compliance Reports is activated as a trial in the Admin Console, or purchased through sales. Record types may not be available yet for iOS and Android devices.

Record Types Controls (General Availability)

Record Types Admin Controls allow administrators to customize the use of record types for their enterprise. Keeper administrators with permission to manage record types, can create new custom record type templates and restrict the use of any record types by role and/or node. (See Admin Console 16.0 release notes or "Compliance Reports" section of the Enterprise Guide for more details on the feature.) To effectively turn off Record Types for your enterprise, create a default role at your enterprise root node and assign a record types enforcement policy that turns off all record types except "General", then assign all enterprise users to this default role.

New Reporting and Alerting Events (General Availability)

See release notes for Admin Console 16.0.0 for the list of new Advanced Reporting and Alerting events logged in support of the new features in this release.

Bug Fixes

• EM-4974: Access permissions for records that are visible through "links" to other records will not be reflected in Compliance Reports. The compliance reports will show only record permissions where the record is shared via a direct share or through a shared folder. An example of this would be a Payment Card linked to a Bank Account record type.

• EM-4979: Record Type records are not successfully transferred on second account transfer after a first successful account transfer.

• EM-4969: When selecting a report criteria filter that includes a deleted node, the Admin Console fails and displays a blank screen.

• EM-4973: No user warning when re-running reporting criteria that includes a user that is no longer associated with the selected node/s.

• EM-4958: Not logging Compliance Reports “exported report” events to ARAM.

Known Issues

• EM-5057: Records shared outside the enterprise to consumers will not show the consumers listed in the report. The records shared with consumers will be listed as "shared" in the report but the consumer user names and permissions will not be shown.

• EM-5056: Some Folder and Record UIDs are not translating correctly when exporting CSV records files to Microsoft Excel.

• EM-4884: Custom record type template changes are not automatically reflected in the Admin Console without a manual sync or administrator login.

• EM-5041: User Reports that are exported before the Compliance Report is generated and saved, are not logged as ARAM events.

• EM-5053: Custom URL fields in records are not captured in Compliance Reports.

New Features

🇺🇸 Support for AWS GovCloud (FedRAMP)

Keeper is currently FedRAMP in-process and public sector entities can now establish their Keeper tenant in the GovCloud environment. Contact the public sector sales team at govsales@keepersecurity.com for more information.

Record Types Admin Controls

Record Types Admin Controls allow administrators to customize the use of record types for their enterprise. Keeper administrators with permission to manage record types, can create new custom record type templates and restrict the use of any record types by role and/or node.

Compliance Reports

Compliance Reports provide on-demand visibility of the access permissions associated with your enterprise records. These reports simplify the compliance auditing process for Sarbanes Oxley (SOX) and other regulations requiring access control monitoring. The user-defined reports can be exported and fed into automated compliance systems or sent directly to external auditors. This is a secure add-on feature to your Keeper license package.

Security Model for Compliance Reports

To support Compliance Reports, certain non-secret fields of the Keeper vault records are encrypted with the Elliptic Curve Enterprise Public Key. Keeper Administrators are able to decrypt the Enterprise Private Key when they login to the Admin Console. Since the reports contain some non-credential encrypted record data, an administrator must have permission to run and view these reports. The encrypted record data is included in the report and can also be used as report filters. The encrypted record data includes:

• Record Title

• Record Type

• URL

Zero-knowledge remains preserved because the encrypted data is decrypted on the Keeper Administrator Console using the Enterprise Private Key, restricted to administrators that have Compliance Reporting permission.

New Reporting Events

The Advanced Reporting & Alerts Module now contains several new event types to cover Compliance Reporting and Record Types.

Bug Fixes

• EM-4867: Renew button is not active on expired accounts

• EM-4871: Node and device type attributes for ARAM not working

• EM-4875: Deleted Users saved in ARAM Report Criteria result in white screen

• EM-4878: Expired accounts cannot pay on the Administrator Login screen

• EM-4904: Event types in ARAM reports erroneously displaying scroll bar

• EM-4875: Deleted users saved to ARAM report results in white screen

• EM-4899: Adding role to a user does not display until admin logs in or manually syncs

• EM-4908: New calendar for a new ARAM user shows “January 1900” for the starting date

• EM-4930: Not able to delete users from enterprise

• EM-4944: User can change email address without a correct master password

• EM-4953: ARAM BreachWatch events are not being listed correctly

• EM-4971: Getting server failure when attempting to move a user to a new node

Known Issues to be fixed before General Availability

• EM-4974: Access permissions for records that are visible through "links" to other records will not be reflected in Compliance Reports. The compliance reports will show only record permissions where the record is shared via a direct share or through a shared folder. An example of this would be a Payment Card linked to a Bank Account record type.

• EM-4979: Record Type records are not successfully transferred on second account transfer after a first successful account transfer.

• EM-4884: Console needs to show changes to custom record types without manual sync or log out / log in.

• EM-4969: When selecting a report criteria filter that includes a deleted node, the Admin Console fails and displays a blank screen.

• EM-4973: No user warning when re-running reporting criteria that includes a user that is no longer associated with the selected node/s.

• EM-4958: Not logging Compliance Reports “exported report” events to ARAM.

Features and Improvements

• EM-4629: Added Role Enforcement to disable Windows Hello

• EM-4550: Added clarification to Data Center chooser on registration

• EM-4804: Node names not appearing in ARAM events for Created Node

• EM-4786: New managed companies showing %NaN

• EM-4511: ARAM Timeline report UI issues

• EM-4435: Usernames are duplicated in ARAM filters

• EM-4810: Improved UI of dashboard when logging in

• EM-4720: New Role Policy to Automatically resend invites every X days

• EM-4859: Console freezes if queued user approval contains user that was deleted

• EM-4843: Inconsistent mouse hover treatment on Create Team link

• EM-3409: Include Date and Time on the User Report

• EM-4708: Prevent deletion of nodes that contain Managed Companies

Bug Fixes

• EM-4811: MSP License Pool does not update on Quick Sync

• EM-4808: Transfer Status does not update on Quick Sync

• EM-4596: IP Blocked events not appearing in ARAM

• EM-4515: Removing Record from Shared Folder not appearing in ARAM

• EM-4731: ARAM alert webhook translations not correct

• EM-4778: Export users on large data set fails

• EM-4762: Searching for user not always showing the best match

• EM-4380: Error logging in with Legacy Edge

• EM-4836: Transfer Account fails silently on corrupted records

• EM-4841: Last 24 hours timeline chart not showing properly

• EM-4853: Isolated nodes are losing setting on logout and login

• EM-4644: Security Audit Tab some users are invisible

New Features

Webhooks

Webhooks are user-defined HTTP requests that are triggered by an application and pushed into other applications.

Popular uses of Webhooks are the following:

• Sending realtime notifications to Slack, Microsoft Teams or other messaging platforms

• Integrating Keeper events into your custom software, hosted in the Cloud

• Developing integrations into Keeper using 3rd party platforms

More Info available here: https://docs.keeper.io/enterprise-guide/webhooks

Improvements

• Performance improvements for customers with a large user base (tested with over 200,000 users)

• New Incremental and Full Sync capability.

• Additional Real-Time pushes of incremental changes with push notifications (for example, when users are added/invited/created you don't need to click "Sync")

• Display of Node Isolation setting within the user interface

• New enforcement policy to disable Security Question & Answer (Account Recovery)

• As a reminder, there is a new enforcement policy to disable HTTP Fill warnings on the Browser Extension. This is helpful for developers and internal websites that don't use SSL.

Bug Fixes

• EM-4624: Selecting non-US country for alert phone number results in invalid phone number

• EM-4584: Timeline Chart does not reflect changes when the various time ranges are selected

• EM-4139: BreachWatch events in Timeline Chart are not visible

• EM-3398: "Removed User from Team" and "Removed User from Role" events are missing from ARAM event types

• EM-4361: White screen appears after adding user to a team

• EM-4633: User receives error message when the default role check box is selected

• EM-4635: The root node is named "root" rather than the organization name

• EM-4637: Admins unable to view ARAM section of console

• EM-4642: A white screen appears when selecting Managed Companies section of console

• EM-4641: A crash occurs when searching for or clicking on a user from the Roles tab

• EM-4647: A white screen appears when attempting to create a custom report in ARAM

• EM-4643: The user's billing history is not appearing in the Subscriptions menu

Improvements

• EM-4424: Addition of a KeeperFill role enforcement policy that enforces all settings/features of the Browser Extension

Bug Fixes

• EM-4556: Syslog push sends the wrong TLS setting to the server

• EM-4559: Sending Keeper Push on a non-SSO account on console generates a reference error

• EM-4562: 2FA duration enforcements are not enforced on clients

• EM-4567: Admin gets a white screen when they receive a device approval request from a user they don't manage

• EM-4569: Selecting "Deny" on device approval request generates an error in the inspector

• EM-4570: Unable to create a trial when linking from an iframe in a 3rd party site

• EM-4574: Change Master Password request fires twice

• EM-4554: Opening console login page in new window when "stay logged in" is enabled, a blank console screen appears

• EM-4544: Account_Recovery is displayed as a key value in ARAM event types

• EM-4540: Account recovery dialogue displays incorrect error text

• EM-4529: Admin's changed email is not displayed at login when "Stay logged in" is enabled

• EM-4507: Master Password Expiration and Logout Timer enforcements are missing duration descriptions

Bug Fixes

• EM-4390: Admin unable to delete Cloud SSO configuration instance

• EM-4364: Logging into a console that contains requests in the approval queue generates an error message

• EM-4460: Reloading the "Create Trial" page does not allow the user to enter an email address

• EM-4456: Key value is displayed for the "Disable in-app onboarding" enforcement policy event in ARAM

• EM-4455: Key value is displayed for the "Restrict persistent login" enforcement policy event in ARAM

• EM-4454: Key value is displayed for the "Restrict commander access" enforcement policy event in ARAM

• EM-4451: Admins are unable to edit an existing custom email invitation

• EM-4450: No error message is presented to the Admin in their attempt to remove themselves from the Keeper Admin role

• EM-4263: Inviting a reserved domain user triggers an incorrect error message

• EM-4423: User receives no feedback on team keys they can't retrieve (due to legacy issues)

• EM-4469: After turning 2FA off, the setting appears to remain on until the Admin logs out/in

• EM-4490: "Pending Transfer Acceptance" status is not displayed when a user is added to the transfer role

• EM-4479: Reset security question tool tip unexpectedly closes when the user attempts to select the presented link

• EM-4476: Key value is displayed for the "out of seats" event in ARAM

• EM-4501: Login with Yubikey generates persistent "Touch Security Key" dialog and generates error message

• EM-4502: User searches for roles in the "User Details" screen are case sensitive

• EM-4497: Admins are unable to select user details for users that are in an invited/blocked state

• EM-4506: Cache race condition causes users that are added/removed from a team to fall out of sync

• EM-4508: A white screen containing errors is displayed when an user selects toggle for the auto logout timer enforcement policy

Features and Improvements

• EM-4148: Search for Roles Feature - Admins now have the ability to search for a role within the "Add User" dialogue by entering a search string to quickly locate and add a user to a desired role. This is particularly helpful for customers that have many roles and their workflow requires adding one or more roles to a single user.

• EM-4471: Support for SAML 2.0 IsPassive option in Cloud SSO

Bug Fixes

• EM-4385: Error message fails to appear when Admin attempts to configure Cloud SSO in the root node

• EM-4378: User is logged out when submitting empty text field(s) in attempt to reset their security question or change their email

• EM-4377: Eyeball icon fails to reveal password in Reset Master Password screen

• EM-4284: RSA SecurID screen notifies the user a text message has been sent rather than requesting the 2FA code

• EM-3880: A 400 error is generated for Save_summary_security_report when a user attempts to login to MC from MSP

• EM-4054: Incorrect error message appears when Admin attempts to move a parent node into a child node

• EM-4444: User unable to reset their security question when 2FA is enabled

• EM-4462: User is unable to close backup code screen upon setting up SMS method for 2FA

• EM-4484: White screen and error in inspector appear when user toggles on the logout timer role enforcement policy

• EM-4413: Improved web socket handling

• EM-4421: "Stay Logged In" language and feature is reversed

• EM-4416: No submit button when creating business trial

• EM-4387: Translations missing on SSO Connect view screens

• EM-3876: Share event type in ARAM has duplicate name

• EM-3820: Emails with slash "/" not receiving email invite

• EM-3701: Email is saved even when "remember email" is unchecked

• EM-4436: No security audit data in admin console for new Managed Company

• EM-4452: Commander SDK platform not enabled by default (reversed)

• EM-4465: Login with Yubikey fails on Firefox browser

Known Issues

The next release, v15.0.4 will contain the following fixes:

• EM-4405: SSO Login with Edge issues

• EM-4380: Login with Legacy Edge issues

Enhancements & Benefits

• EM-4446: "Deny" button has been added to the Device Approval Screen

• EM-4398: Addition of persistent session enforcement policy

• EM-4394: Addition of disable onboarding enforcement policy

• EM-4365: Support for new methods of Device Approval (Keeper Push, Admin Approval)

• EM-4206: Addition of session persistence setting, allowing Admin to stay logged into Keeper when they close their browser or restart their computer

Bug Fixes

• EM-4427: Entering characters in the IP address(es) allowed field causes a crash and generates errors

• EM-4419: DUO push fails on "Forgot Password" flow

• EM-4418: User receives error attempting the "Forgot Password" flow after entering new password

• EM-4328: White screen appears upon entering approval queue after deleting last user approval request from list

• EM-4232: During the account recovery flow, the user's cursor defaults to the second field of the new password screen.

• Various design errors and inconsistencies

Features & Benefits

• Keeper SSO Connect™ Cloud leverages Keeper’s zero-knowledge security architecture to securely and seamlessly authenticate users into their Keeper Vault and dynamically provision user vaults to the platform. Keeper supports all popular SSO IdP platforms such as Okta, Microsoft Azure, Google G Suite, Centrify, OneLogin, Ping Identity, and more. This service does not require any on-premises or customer cloud-hosted services and there are no Master Passwords. Configuration is done directly between the IdP and Keeper's Admin Console. More information available here: https://docs.keeper.io/sso-connect-cloud/

• Login V3 General Availability (GA) More information available here: https://docs.keeper.io/enterprise-guide/login-api-v3

Bug Fixes

• EM-4360: Device approval events in ARAM reports are displayed as key values

• EM-4352: SAML Debug Log is incorrectly sorted from oldest to newest

• EM-4341: User unable to change Cloud SSO service endpoints

• Various design inconsistencies

Features & Benefits

• Privacy Screen - Admins now have the ability to control the viewing (unmasking) of passwords based on a specified domain. This policy is enforceable by the Admin for individual domains within each of their Generated Password Complexity settings by enabling "Apply Privacy Screen".

• Master Password Re-entry Enforcement - This role enforcement allows Admins to require their users to re-enter their Master Password in order to unmask or copy a password. Once unmasked, the password will be re-masked after 30 seconds have passed.

• Sharing & Uploading Enforcement Policy - This role enforcement policy allows Admins to prevent their users from importing records from Web App and Desktop App.

• Auto-Approval of Teams in the Admin Console - Rather than requiring a manual approval from within the approval queue, queued teams (via SCIM and Bridge) are now automatically approved. Additionally, active users will automatically be added to their relevant teams.

Bug Fixes

• Fixed: Managed Companies are not being added to the intended node.

• Fixed: Restrict import enforcement events are displayed as a key value in ARAM.

• Fixed: There are no available attributes for the user to select from the dropdown menu in the SCD Provisioning dialog.

• Fixed: Error message received when an Admin attempts to move a Managed Company to another sub node.

• Fixed: Various design issues.

Benefits & Enhancements

• Saving Enforcement Policies - This update includes the removal of the "Save" button from the Enforcement Policies screen. Any changes the Admin makes to the Enforcement Policy Settings, will now save automatically as the changes are being made.

Bug Fixes

• Fixed: An error message is generated when an Admin attempts to switch the toggle on/off for "Logout Timer" Enforcement Policies.

• Fixed: An error message is generated when an Admin attempts to switch the toggle on/off for "Purging Deleted Records" Enforcement Policies.

• Fixed: Some enforcements when selected or changed, display key values.

• Fixed: Adding a user to a pending transfer role fails to update the user's status until a manual sync is initiated.

Bug Fixes

• Fixed: The scrollbar is missing when 50 or 100 users are selected in the SCD Provisioning window.

• Fixed: Moving a user from the root node to a sub node causes the sub node user list to appear empty.

• Fixed: Various design and alignment issues.

Features & Enhancements

• Team-to-Role Mapping - This release introduces team-to-role mapping, a major improvement to the way Admins manage role-based access control policies (RBAC) across their organizations. This allows Admins to use their existing identity provider to assign users directly into teams that can be assigned custom roles. Furthermore, a user who is a member of a team assigned to a role, will assume the enforcement of that given role. This new feature will not only increase efficiency when managing role enforcements, but improve policy consistency and reduce the occurrence of errors.

• Subfolders Included in Vault Transfers - A transferred account will be replicated in its structure and content and will now include subfolders. All data will be transferred to the recipient and housed in a dedicated transfer folder, named to match the original owner's email address, and will include all transferred records, folders, and subfolders.

• Improved UI - Admin Console provides improved UI support for small screen laptops and tablet devices.

Bug Fixes

• Fixed: A "Request Failed" error appears when a Admin user's session times out.

• Fixed: SCD Provisioning user dialogue does not display the correct user count when all users are selected.

• Fixed: A secondary prompt briefly opens and closes after a user closes out of the "Transfer Account" prompt.

• Fixed: The "Timeline Chart" report in ARAM displays all available events rather than defaulting to the relevant events specific to that report.

• Fixed: Various spacing and alignment issues.

Enhancements & Benefits

• KeeperFill Browser Extension Enforcement Update - Admins now have the ability to prevent their users from enabling the Auto Submit and Prompt to Fill features in the KeeperFill Browser Extension.

• Two-Factor Authentication Enforcement Update - Admins now have the ability to disable 2FA for their users without having to contact Keeper support.

Bug Fixes

• Fixed: The "accept" button is unresponsive when an Admin attempts to accept a vault transfer within the console (the user is still able to accept the transfer from their vault).

• Fixed: An error message is received when a user attempts to resend a code for SMS 2FA (Two-factor Authentication).

• Fixed: Users are unable to modify the name of the MSP "license purchaser" role.

• Fixed: When an Admin sets the logout timer enforcement setting for web apps to 180 minutes, users are only able to set their logout timers to a maximum of 2 minutes.

Enhancements & Benefits

Edit User Module Enhancement - Previously, roles and teams that were removed via the edit user module, were unable to be re-added without saving and re-opening the module. An enhancement to the module has provided the ability for Admins to easily re-add roles and teams if removed by mistake, for example.

Bug Fixes

• Fixed: Although users are correctly prompted at login for their security key, active keys are not appearing in the security key section of the console after user logs out and back in again.

• Fixed: Teams and users are not consistently displayed across categories, causing the inability to add teams from the users section.

• Fixed: Creating a new role that has administrative permissions (that includes transfer), prevents users from being added to that role.

• Fixed: The option to unlock a user's account is not available once it has been locked from the edit user module.

• Fixed: Various errors in design and visual prompts.

Enhancements & Benefits

• Enterprise Data Removed from Application State - Large enterprises that were previously experiencing slow functionality when making changes (primarily in the Admin section of the Console) will now experience faster response time due to the separation of enterprise data from the user interface state.

• LogRhythm SIEM Provider Update - A high resolution image update was created for LogRhythm, a SIEM (Security Information and Event Management) provider.

Bug Fixes

• Fixed: The Managing Node drop-down menu within Managed companies is not displaying all available nodes.

• Fixed: Current 2FA (Two-Factor Authentication) status is not displayed as expected within the Console Settings.

• Fixed: The license history for Managed Companies is not correctly calculating net changes.

• Fixed: Admin receives error message or unresponsiveness when attempting to delete or rename nodes within the Console.

• Fixed: Error message does not present when an SSO user attempts forgotten password flow.

Benefits & Enhancements

• Support for LogRhythm SIEM Provider - This release supports connectivity to LogRhythm, a SIEM (Security Information and Event Management) provider.

• Full Node Structure for MSPs - The limitations for node structure creation have been removed, allowing for full node structure and provisioning methods as well as the creation of Managed Companies within sub-nodes.

Bug Fixes

• Fixed: When an Administrator creates a new role, the name of that role cannot be edited.

• Fixed: An error message is displayed as a key value when the SCIM (System for Cross-domain Identity Management) provisioning method is added to a node (other than the root node) when no values are entered by the user.

• Fixed: Various visual issues, including key values incorrectly being displayed as errors.

• Fixed: Selecting "Manage Companies (MSP)" is not saved when creating a new role and assigning user permissions.

• Fixed: When a user logs in with Duo 2FA and selects "Don't ask for 30 days" they are incorrectly prompted again for Duo 2FA at next login.

• Fixed: The settings for platform restrictions are not immediately reflected, requiring user to log out and back into the console to view changes.

• Fixed: When selected as a secure add-on, the free trial for KeeperChat freezes the Console requiring the user to reload their browser.

• Fixed: 2FA remains toggled on in security settings after previously being toggled off.

• Fixed: The "Export" button within the Security Audit tab of the Admin Console does not work (Firefox).

• Fixed: Various design issues, such as alignment and overlapping.

Bug Fixes

• Fixed: Inability to add users to the administrative role after clearing cache or hard refreshing browser.

• Fixed: User unable to remove a managed company that is in a "paused" state because "Remove" button is inactive.

• Fixed: MSP administrator unable to log into Managed Company Console after setting-up 2FA Google Authenticator or SMS.

Benefits & Enhancements

• Support for MSP Deployments - Seamless log in for MSP admins to a Managed Company.

• Hyperlink Update - "Schedule a Demo" hyperlink for MSP users has been updated to Calendly.

• Team Management by Admin - Admins are now able to manage existing teams (add/remove users) without being assigned to that team.

Bug Fixes

• Fixed: Various buttons within Managed Companies and Admin Tabs are not working correctly.

• Fixed: The advanced PBKDF2 Iterations setting should default to 100,000 instead of 10,000.

• Fixed: An issue causing the Managed License Pool incorrectly track the removal of licenses.

• Fixed: User is unable to activate and use Yubikey as expected within the Console.

• Fixed: Infinite loading spinner appears when returning from DUO authentication page; user forced to refresh or close Console page.

• Fixed: Various design inconsistencies and errors.

Bug Fixes

• Fixed: Custom email content disappears after creation upon navigating in and out of the setting as well as from the "Edit" Screen.

• Fixed: "Teams" rather than "User" appear for approval in the approval queue.

• Fixed: No change takes place when user attempts to reset their security question (IE Browser)

Bug Fixes

• Fixed: Broken Breachwatch and Security Audit screens within the user interface.

Benefits & Enhancements

• Hyperlink Update - "Schedule a Demo" hyperlink has been updated from Calendly to choice of: On Demand, Live Weekly, and Customized demo options.

Bug Fixes:

• Fixed: Login page is performing a valid email check on every keystroke instead of when user selects the "Login" button.

• Fixed: A checkout token is not created when user logs into an expired account and attempts to renew their subscription.

• Fixed: Various display and design issues.

Features & Benefits

A full user status report can be downloaded from the Admin Console Dashboard view. To download the report, click on (...) then "Download"

The report is a .csv file that contains the following columns:

1. Email

2. Name

3. Active/Invited Status ("active" or "invited")

4. Locked/Disabled Status ("locked")

5. Blocked/Pending Transfer ("blocked")

6. Last Login Date

7. Node Tree

8. Roles (pipe-delimited)

9. Teams (pipe-delimited)

Bug Fixes

• Unable to add users to roles from certain screens. Fixed.

• Unable to delete company logo. Fixed.

• Filtering on user status does not work. Fixed.

• Various bugs in team management.

• Export button in Timeline charts not working. Fixed.

• White screen experienced when moving users between nodes and logging in.

This is a major feature update and bug fix release.

Features & Benefits

• Password Generator Enforcement policy You can now specify the password generator complexity policy on a per-domain basis, or using wildcards can specify a larger matching pattern against domain names. This role enforcement feature has been added to the Vault Features screen.

• Ability to specify the time zone when reporting alerts are sent via email and text message.

• Added Azure Monitor Log Analytics and Generic Syslog to the list of supported External Sync targets.

• Improved checkout flow from Admin Console to payment page via tokenization that does not require additional email validation.

Bug Fixes

• F5 SSO Login issues on EU account in Safari, Admin accounts

• Provisioning methods not being removed after deletion until logout/login

• Display names under individual reports not linking to user detail

• Selecting the "Settings" button causes errors in the console log

• Add User dialog from Roles hangs the browser

• YubiKey not prompted and defaults to backup 2FA method

• Firefox setup of YubiKey not working

• Change email address feature not sending verification code

• Editing user results in blank screen

• Last email address used is showing up in login after logging out

• Resolved issues adding members to teams from certain views

This is a bug fix release focused on the BreachWatch business 14.1.0 release.

Bug Fixes

• Visual UI optimizations

• Improved loading speed of initial login on new device

• Internet Explorer UI issues

• Accepting Vault Transfer prompt results in error

• Duo Push errors on login

• Approval Queue UI issues

• Clicking on tabs runs a data sync to improve responsiveness to new data

• Localizations in German

Features

• New Keeper logo, branding, fonts and colors

This is a major feature update for BreachWatch Business.

Features & Benefits

• BreachWatch Business V1 Launch

• New Dashboard View

• Optimized Node Tree navigation for customers with a large number of nodes

• Incorporation of BreachWatch events in Advanced Reporting & Alerts Module

• BreachWatch detail screens

• Refactor of Security Audit screen to consolidate and simplify the UI

• Billing support for BreachWatch Business

• New Approval Queue screen incorporated into left navigation

• Additional BreachWatch-related enforcement policies

• Improved Search UI along top header

For detailed BreachWatch related updates visit the below links:

BreachWatch (Dark Web)Enterprise Guide

BreachWatch: Now Available for Business & Enterprise Customers - Keeper Security Blog - Cybersecurity News & Product UpdatesKeeper Security Blog - Cybersecurity News & Product Updates

Bug Fixes

• Unable to login as Sub-node admin

• Blank page when adding a role

• App crashes on logout timer settings changes

This release is focused on bug fixes and performance improvements.

Issues Resolved

• Search the console within Internet Explorer

• Audit & Reporting visual issues

• Inviting users from another enterprise account caused confusion

• Reduce the number of Audit Event alerts on multi-record operations

• German translations missing in several screens

• Subnode beneath the root node is being highlighted by default when logging in

This release is focused on bug fixes and performance improvements.

Issues Resolved

• Purchase issues with Advanced Reporting & Alerts Module

• YubiKey login stores the 2FA token longer than the enforcement policy

• Email invitation formatting

• Audit report events with backslashes showing in event name

• Duo Security login issues related to storage of 2FA device token

• Formatting of Audit and Reporting display

• Cascade Node Permission error

• Searching within sub-node administrators

• Timeline chart display issues

• Highlight text color more readable

• Localization issues

• Security Score calculation issues

Features & Benefits

• Enable/disable offline mode, now with web browser support (Chrome, Firefox, Safari, Edge)

• Enable/Disable use of a Master Password with Single Sign On for use both online and offline.

• New enhanced search capability

• Security updates (additional encryption layer) for v14 Backend API

Bug Fixes

• Added event tracking for "Activated Email Provisioning"

• Visual Improvements

• IBM QRadar integration bug fixes

• Various minor UI bug fixes

• User redirect issues resolved with Google SSO Admin

• Throttled user login with SSO does not generate error message

• SMS setup in 2FA did not display error when entering the wrong code

• Page crashes clicking on certain Alert screens

• 2FA token not retained on the Admin Console when "prompt every time" is enforced

What's Next

BreachWatch for Business and a new enhanced Dashboard is coming in the next release (14.1.0) of the Admin Console

Reporting & Alerts Module

The all new Reporting & Alerts module is a powerful Add On which provides customized event-based reporting and auditing capabilities.

Enhancements & Benefits

• Major new functionality is provided in this release via the optional Advanced Reporting & Alerts Module.

  • Based on 75+ events generated from Keeper client devices and activities utilizing the Keeper backend

  • Maintains strict Zero-Knowledge architecture, no reveal of record information possible to administrators

  • Offline events are buffered on client then uploaded when reconnected

• Events Timeline

  • Displays Top 5 events (those with highest event counts) during the period

  • Period selectable between Last 30 Days, 7 Days, or 24 Hours.

  • Shows % of total for each event

  • Customizable to show different events (other than Top 5)

  • Mouseovers to show each date

• Reporting Engine

  • Basic report for Recent Activity includes all events

  • Advanced allows customizing and saving reports

  • Wide variety of events types & attributes to focus views

  • Customizable column headings

  • Exportable log data to SIEM, Syslog, spreadsheets, etc.

• Alerts

  • Choose from wide array of event types and attributes via filters

  • Send alerts via email or SMS text

  • Control frequency of alerts with multiple types of settings

• 3rd Party Secure Information & Event Management support via External Logging

  • External logging of all events

  • Simple set up for Splunk, Sumo, Amazon S3, IBM QRadar

• All reported events are also available from the Keeper Commander SDK

Known Limitations

• No limit on events logged

• Report viewer limited to showing up to 1000 events at a time (10 pages of 100 events)

• Maximum 100 SMS alerts per day (per enterprise)

  • No limit on Email alerts

• QRadar support not available yet

Coming Soon

Enhancements & Benefits

• Improved mobile / tablet support

• Enterprise licensing flows and subscription management

• Left-hand navigation

• Major performance improvements to Recent Activity backend event tracking

• Preparation for upcoming Advanced Reporting & Alert module

Known Limitations

• The "Recent Activity" screen is limited to 16 event types, and will only retrieve the most recent 1,000 events from the backend system. Please use Keeper Commander API for full event logging historical data and integration into SIEM systems.

Coming Soon

• Admin Console version 13.3 contains a major advancement of the event reporting capabilities in Keeper Enterprise and will be available for beta evaluation on February 15, 2019 and full launch on February 25, 2019. Please contact your Keeper sales representative for early access.

Enhancements & Benefits

This release contains several new role enforcement policies, visual improvements to the role enforcement policy section, additional refinements for existing role policies, and bug fixes to address known customer issues.

Custom Logout Timers

Previously, logout timer enforcements were limited to certain intervals between 1 minute and 24 hours. Now, you can customize the value of the logout timer in increments of minutes. To enforce a logout timer, turn the switch to the ON position and then specify the logout timer setting as seen below.

Note, "Disable email invitations" enforcement policy was also moved into this Account Settings role enforcement policy screen.

Platform Restrictions

By default, access is granted on all role enforcement policies. We have now added KeeperChat platform restriction policies. You may restrict the use of KeeperChat on Desktop and Mobile devices.

Vault Feature Policies

We have added a series of enforcement policies related to features within the Keeper Vault that appear in the "Vault Features" screen. The new policies added are the following:

1. Prevent users from creating folders

2. Prevent users from creating Identity and Payment records

3. Mask custom fields

4. Mask notes

5. Mask passwords

6. Day(s) before records can be cleared permanently

7. Day(s) before deleted records automatically purge

The screenshot of these policies can be seen below.

Notes:

• When masking is enforced on custom fields, notes and passwords, this has the effect of replacing all of the content on the screen with dots as seen below. Clicking on the eyeball icon will display and hide the content within the field.

• "Purge Deleted Records" enforcements prevents a user from deleting items in their vault and then immediately purging their deleted records permanently.

Here's an example of a record showing masked password, custom field and notes:

Sharing & Uploading Policies

A new role enforcement policy called "Prevent sharing records with file attachments" has been added. By default, this ability is permitted.

KeeperFill Restrictions

There is now a new screen called "KeeperFill" which controls the behavior of the KeeperFill browser extension for Chrome, Firefox, Safari, Edge and IE.

"KeeperFill disabled for specified websites" is a policy which will completely disable the KeeperFill browser extension on sites which match the list provided. You can add any number of sites to the list of disabled websites, and you can also include wildcard characters. This policy was created to address some websites or internal applications that are not friendly to browser extensions, or which impact the performance of the application.

Master Password Expiration

Similar to the improvements on logout timer settings, the "Master Password Expiration" policy can now be configured with a customizable number of days, instead of selecting from a pre-defined list.

Bug Fixes and Performance Updates

• Fixed issue where users can't login to Admin Console with expired account transfer consent status

• Sorting issues on several screens

• RSA and Duo 2FA related issues

• Recent Activity visual date issues

• Fixed missing localization strings in certain languages

Known Limitations

This release will initially be supported only by these Keeper clients:

• Browser Extensions

  • 12.27 (Chrome, Safari, Edge, Firefox)

  • 12.30 (Chrome, Safari, Edge, Firefox, Internet Explorer)

• Keeper Web Vault

Coming soon...

All role enforcement policies will be fully supported on the following clients in upcoming releases:

• iOS 14.2

• Android

• Surface

• Microsoft Desktop application

Bug Fixes

EM-4459: Users unable to create Business or MSP trial in Microsoft Edge browser; screen spins and "uncaught (in promise) DomException" error is generated