Resolving record titles

How to produce an audit-report that displays decrypted record titles instead of record UIDs, using Keeper Commander.

---

Showing Record Titles in Audit Reports

By default, audit event data identifies each record by its Record UID rather than its title. This is a property of Keeper's zero-knowledge architecture: record titles are encrypted with keys held only by authorized users, so the backend that generates event data cannot decrypt a title to display it. The UID is the only stable record identifier the server can return.

Keeper Commander can resolve those UIDs into human-readable titles locally, where the decryption keys are available. This page describes how to generate an access report that includes the decrypted record title.

Running audit reports requires the Advanced Reporting & Alerts Module (ARAM) add-on. Resolving titles for records the reporting administrator does not own additionally requires the Compliance Reports add-on (see Title Resolution below).

Command

My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --format csv --output access.csv

This produces a CSV in which each open_record event includes the record_uid, the decrypted record_title, and the record_url.

Parameters

Parameter	Description
--report-type raw	Returns individual events rather than aggregated counts.
--event-type open_record	Filters to record-access events. Accepts the event code, not the console message text (see Selecting the Event Type).
--report-format fields	Breaks each event into one column per attribute. Required for titles to appear (see Why --columns Does Not Work on Raw Reports).
--max-record-details	Allows retrieval of additional record-detail data (title, URL) for records not available locally in cache.
--format csv	Output format. One of table, csv, json, pdf.
--output access.csv	Writes the report to the named file.

Why --columns Does Not Work on Raw Reports

On a raw report, the --columns option is ignored. Adding record_title to --columns and running a raw report returns only UIDs.

For raw reports, the column layout is controlled by --report-format:

• message (the default when the flag is omitted): a single rendered-sentence column, plus the base set created, audit_event_type, username, ip_address, keeper_version, geo_location.
• fields: one column per attribute. The record_uid field automatically expands to also include record_title and record_url.

The --columns option applies only to the summarized report types (dim, hour, day, week, month, span).

Selecting the Event Type

--event-type expects the event code, not the activity-log message. The console string "revealed password on record UID ..." is a display template. There is no reveal_password code; passing it returns bad_inputs_audit_event_type.

To list the valid event-type codes for your account, run a dimension report:

My Vault> audit-report --report-type dim --columns audit_event_type

Record-access codes most relevant to "who accessed this credential":

• open_record (Opened Record): the user opened the record's detail view.
• copy_password (Copied Password to Clipboard): the credential was copied out of the vault.

Keeper does not emit a distinct event for unmasking a password field, so open_record is the appropriate access signal.

Title Resolution

Title resolution operates in two tiers:

1. Records owned by, or shared with, the administrator running the report resolve from the local vault cache automatically.
2. Records the administrator does not hold (for example, another user's records) resolve from Compliance Reports data. This path is used only when --max-record-details is supplied and the Compliance Reports add-on is enabled.

{% hint style="info" %} If the report succeeds but the record_title column is blank for another user's records, either --max-record-details was omitted or Compliance Reports is not enabled on the account. {% endhint %}

Examples

Display all open_record events from the last 30 days with decrypted titles, saved as CSV:

My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --created last_30_days --format csv --output access.csv

Display every record a specific user accessed, with title and URL, forcing detail retrieval for records not held locally:

My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --username [e-mail] --format table

Return all matching rows with no row cap:

My Vault> audit-report --report-type raw --event-type open_record --report-format fields --max-record-details --limit -1 --format csv --output access.csv