Compliance Commands
Keeper Commander compliance reporting commands
About
Compliance reports let account administrators adhere to regulations by providing on-demand visibility to access permissions on records and credentials across the enterprise.
Using Commander, compliance reports can be scheduled and automated, and results can be exported to a CSV file or JSON.
For more information about Compliance Reports, see the Compliance Reports documentation:
The compliance-report command
The compliance-report command allows you to run reports just as you would in the Keeper Admin Console. See record permissions by node, user and title, filter by owned or shared records and output results to a file.
Cache
The compliance-report command relies on a cache in order to improve performance across multiple report queries.
This means that the first call to compliance-report may take several minutes as the system pulls in the required data.
During this time, Commander will display messaging explaining the current step.
Additionally, a manual rebuild of the cache can be performed with the -r flag. Do this to see recent changes in the compliance data.
compliance-report -r
Conversely, if you would like to circumvent the automatic cache-refresh behavior described above and generate a report based solely on previously cached data (resulting in possibly stale results but nevertheless useful for avoiding the possibly long loading times required to refresh the cache), you can do so with the -nr or --no-rebuild flag. Do this to quickly perform queries on compliance data in cases where you can be fairly confident that the relevant data have not changed significantly since the last command call / cache refresh.
compliance-report -nr
Removing the Cache
The compliance report cache can be removed manually with the --no-cache flag. When run, this completely removes all cached compliance report information from your machine.
compliance-report --no-cache
Alternatively, you can delete the cache file locally on disk from the location where you ran Commander. Delete the file called sox_<ID>.db which contains the encrypted compliance data.
Filtered Query Performance
When using --username or --team filters, Commander only refreshes cached data for the targeted users rather than the entire enterprise. This applies to compliance-report and compliance record-access-report.
Filters
The compliance report can be filtered by Node, User, Job Title and if the record is shared, deleted, or active.
Outputting to a File
Like many Commander reports, the compliance report results can be saved to a file. To do this use the --output and --format options.
Output
--output [FILE PATH]
Tells Commander to write results to a file at the given location. If no file exists it will be created.
Format
--format [csv, json, table]
Tells Commander the format to write the report results as. The default result is in table format, which displays a formatted table of results. The other options are Comma Separated Values (CSV), JavaScript Object Notation (JSON).
The compliance command
In addition to enabling users in generating custom reports, Commander also provides users the ability to generate specific reports with the compliance command. These specific reports can be generated by invoking the compliance command's supported sub-commands.
The compliance command supports the following sub commands:
Refer to the sub command's section for more information.
Compliance Team Report
Shared folders can be shared to Keeper Teams as well as individuals. The compliance report can display a report of the access that each team has to these shared folders.
To run the Compliance Team Report, use the following command in Commander:
compliance team-report
This report uses the compliance report cache described above.
The report shows each team that has access to a shared folder, and what access it has to that shared folder.
When filtering by --team, the --resolve-teams flag expands matching to also include shared folders where team members are individually present (not just folders shared directly to the team):
compliance team-report --team "Engineering" --resolve-teams
Compliance Record-Access Report
The compliance record-access report displays a list of all records that either a) have been accessed by, or b) are currently accessible to any given user(s), along with other relevant information (e.g., app used, IP address, event timestamp, etc.).
To run the Compliance Record-Access Report and show a user's record-access history, run the following command in Commander:
compliance record-access-report --email user1@company.com
where user1@company.com is the user whose record-access activity we'd like to audit, with the resulting output being something like the following:
Similarly, to show a list of all records that are currently accessible by that same user (i.e., all records currently in the user's vault), run the following command:
compliance record-access-report --report-type vault --email user1@company.com
The output of the above command should look similar to the previous example, but will exclude records that are not currently in the user's vault and may include records that have never been accessed by that user.
Recommended Workflow for Complete Vault Visibility
To get a complete user-level view of all records a user can access (owned records plus records shared into that user's vault), run both commands below and merge on both user and Record UID:
compliance report --username user1@company.com --format json --output "./user1_owned.json"
compliance record-access-report --report-type vault --email user1@company.com --format json --output "./user1_vault.json"
Join where compliance report.username == rar.vault_owner and record_uid matches.
Use compliance report as the owned-record source and compliance record-access-report --report-type vault as the sharing-relationship source.
In some Commander versions, --report-type vault may not include all shared records. For complete vault visibility, use the recommended workflow above.
Additionally, if you would like to run this report for multiple users, you may do so by 1) specifying each username / ID separately, 2) by using the "@all" shorthand to indicate that you would like to run the report for all users or 3) by not providing a user — yet a more concise way to include all users in the report. This is illustrated in the following corresponding examples:
compliance record-access-report -e user1@company.com -e user2@company.com
compliance record-access-report --email @all
compliance record-access-report
The --aging flag can be added to include Created, Last Modified, Last Password Change, and Last Rotation columns:
compliance record-access-report --email user1@company.com --aging
compliance record-access-report --email @all --aging --format csv --output "./rar_aging.csv"
Compliance Summary Report
The compliance summary report displays aggregate information about records within the enterprise (grouped by record-owner by default for now, but support for grouping by other entities may be added to this feature later)
To run the Compliance Summary Report, run the following command in Commander:
compliance summary-report
or
compliance stats
with the resulting output being something like the following:
Compliance Shared-Folder Report
Similar to compliance team-report, this command outputs a report detailing the access that all entities (teams as well as individual users) have to all shared folders within the enterprise.
To run the Compliance Shared-Folder Report, run the following command in Commander:
compliance shared-folder-report
or
compliance sfr
with the corresponding output:
The --resolve-teams flag can be used to expand --team filtering to also include shared folders where team members are individually present:
compliance sfr --team "Engineering" --resolve-teams
See the Reporting Documentation for other reports available in Commander
Last updated