Audit Log Report Command

Audit Log

This command/function helps to exports Keeper enterprise audit events to external systems or local files. It supports record-backed configuration and incremental export state, similar to Python Commander.

DotNet CLI

coming soon

DotNet SDK

Comming Soon

PowerCommander

Command: Export-KeeperAuditLog

Alias: kal

Parameter:

• -Target Export destination: json, syslog, splunk, sumo, azure-la, syslog-port
• -Record Keeper record title or UID used to store export configuration and incremental state
• -FilePath Output file path for json and syslog
• -Url Endpoint URL for splunk and sumo
• -Token Splunk HEC token, Required for splunk.
• -SyslogHost Remote syslog server host for syslog-port
• -SyslogPort Remote syslog server port for syslog-port t
• -SyslogProtocol tcp or udp for syslog-port
• -UseSsl Use TLS for syslog-port over TCP
• -OctetCounting Use RFC 5425 framing for syslog-port
• -WorkspaceId Azure Log Analytics workspace ID
• -WorkspaceKey Azure Log Analytics workspace key
• -SharedFolderUid Filter by shared folder UID
• -NodeId Filter by enterprise node ID
• -Days Export only events from the last N days
• -LastEventTime Resume export from a previous Unix timestamp
• -Anonymize Replace usernames and emails with enterprise user IDs
• -IgnoreCertificateErrors Ignore certificate validation errors for splunk, sumo, and azure-la

Examples:

PS > Export-KeeperAuditLog -Target json -FilePath "audit_events.json" -Days 7
Exported 4271 audit event(s).                                                                                 

ExportedCount LastEventTime Target Success
------------- ------------- ------ -------
         4271    1774947466 json      True

Python CLI

Comming Soon

Python SDK

Comming Soon