# Audit Report Command

### Audit Report

This command/function helps to display a list of reports with proper message.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --limit 50`

It returns a list of reports with created date, username, event type and message.

**Parameter:**

`limit` - Limit number of rows.

**Examples:**

```sh
My Vault> audit-report --limit 50
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Alias:** `kar`

It returns a list of reports with created date, username, event type and message.

**Parameter:**

`-Limit` - Limit number of rows.

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport -Limit 5
Created             Username                    Event             Message
-------             --------                    -----             -------
24-03-2026 11:02:25 test1@example.com            login             User a1@gmail.com… 
24-03-2026 11:02:25 Exampl1                      audit_alert_sent  Audit alert "A12" was sent to th… 
24-03-2026 11:01:52 user@example.com             app_client_access KSM device TestRoyalts has acces… 
24-03-2026 11:01:52 Exampl2                      audit_alert_sent  Audit alert "Jira Alert - Test" … 
24-03-2026 11:01:52 Exampl3                      audit_alert_sent  Audit alert "A12" was sent to th… 
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Example:**

```
My Vault> audit-report --report-type raw
Created                    Audit Event Type    Username                          IP Address    Keeper Version      Geo Location      Message
-------------------------  ------------------  --------------------------------  ------------  ------------------  ----------------  -------------------------------------------------------------------------------------------------------------------------------------
2026-04-27 16:55:05+05:30  login               a.test1@keepersecurity.com  10.5.12.58    Commander 17.2.0    null, null, null  User a.test1@keepersecurity.com logged in to vault (PASS)
2026-04-27 16:54:49+05:30  login               a.test1@keepersecurity.com  10.5.11.246   Commander 17.0.0    null, null, null  User a.test1@keepersecurity.com logged in to vault (PASS)
2026-04-27 16:54:49+05:30  device_approved     a.test1@keepersecurity.com  10.5.11.246   Commander 17.0.0    null, null, null  Device Python Keeper API is approved for user a.test1@keepersecurity.com
2026-04-27 16:53:06+05:30  login               p.test@keepersecurity.com   10.5.12.58    SupportTool 17.3.0  null, null, null  User p.test@keepersecurity.com logged in to vault (PASS)
```

</details>

<details>

<summary>Python SDK</summary>

Coming Soon

</details>

### Audit Report Pattern Prefixes

This command/function displays a list of reports for matched individual regex patterns.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report "regex:login.*"`

**Parameter:**

`regex:<pattern>` - Individual regex pattern.

`exact:<text>` - Exact string match.

`not:exact:<text>` - Negation filtering.

**Examples:**

```sh
My Vault> audit-report "regex:login.*"
```

```sh
My Vault> audit-report "exact:record_update"
```

```sh
My Vault> audit-report "not:exact:login"
```

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Alias**: `kar`

**Parameter:**

`regex:<pattern>` - Individual regex pattern.

`exact:<text>` - Exact string match.

`not:exact:<text>` - Negation filtering.

**Examples:**

{% code overflow="wrap" %}

```ps
PS > Get-KeeperAuditReport "regex:login.*"

Created             Username                        Event            Message
-------             --------                        -----            -------
24-03-2026 11:23:45 test1@example.com             login            User test1@Exampl                      .com logged in to vault (PASS)
24-03-2026 11:23:09 test2@example.com             login            User test2@example.com logged in to vault (PASS)
24-03-2026 11:11:32 test3@example.com             login            User test3@example.com logged in to vault (PASS)

PS > Get-KeeperAuditReport "exact:login_failure "

Created             Username                     Event         Message
-------             --------                     -----         -------
24-03-2026 11:01:14 test3@example.com         login_failure     User test3@example.com login failed with code invalid_credentials
24-03-2026 11:01:08 test3@example.com         login_failure     User test3@example.com login failed with code invalid_credentials
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>

### Audit Report Match-all

This command/function displays a list of reports for multiple matched patterns.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report "exact:audit_alert_sent" "exact:A12" --match-all`

**Parameter:**

`exact:<text>` - Exact string match.

`match-all` - AND logic (all patterns must match).

**Examples:**

```powershell
My Vault> audit-report "exact:audit_alert_sent" "exact:A12" --match-all
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Parameter:**

`exact:<text>` - Exact string match.

`-MatchAll` - AND logic (all patterns must match).

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport "exact:audit_alert_sent" "exact:A12" -MatchAll

Created             Username Event            Message
-------             -------- -----            -------
24-03-2026 11:30:00 user1    audit_alert_sent Audit alert "A12" was sent to throttled
24-03-2026 11:23:45 user2    audit_alert_sent Audit alert "A12" was sent to throttled
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>

### Audit Report Report-type

This command/function displays a list of reports for particular report type.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --report-type span --columns username audit_event_type`

**Parameter:**

`report-type` - Type of report like `raw, hour, day, week, month, span, dim` .

`columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

**Examples:**

```sh
My Vault> audit-report --report-type day --columns audit_event_type
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Parameter:**

`-ReportType` - Type of report like `raw, hour, day, week, month, span, dim` .

`-Columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport -ReportType span -Columns username,audit_event_type

username                          audit_event_type
--------                          ----------------
Deleted User ID: -6                audit_alert_sent
test1@example.com                  folder_add_record
test1@example.com                  folder_remove_record
Deleted User ID: -8                agent_added_to_collection
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>

### Audit Report Aggregate

This command/function displays a list of reports with aggregate columns.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --report-type day --aggregate occurrences`

**Parameter:**

`aggregate` - Aggregate columns like `occurrences, first_created, last_created` .

**Examples:**

```sh
My Vault> audit-report --report-type day --aggregate occurrences last_created      
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Parameter:**

`-Aggregate` - Aggregate columns like `occurrences, first_created, last_created` .

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport -ReportType day -Columns username,audit_event_type -Aggregate occurrences 

    occurrences username                          audit_event_type
----------- --------                          ----------------
    2474462 Deleted User ID: -6               audit_alert_sent
     264270 test1@example.com                 folder_add_record
     168258 test1@example.com                 folder_remove_record
     124023 Deleted User ID: -8               agent_added_to_collection
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>

### Audit Report Filters

This command/function displays a list of reports based on filters.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --report-type day --created today --columns username ip_address --order asc`

**Parameter:**

`report-type` - Type of report like `raw, hour, day, week, month, span, dim` .

`columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

`order` - Change the report list order `asc or desc` .

**Filters**:

`created` - Created filter like `today, yesterday, last_7_days, last_30_days, month_to_date, last_month, year_to_date, last_year` .

`event-type` - Filter by event-type like `login, record_update` .

`username` - Filter by username.

`to-username` - Filter by event's target.

`record-uid` - Filter by record.

`shared-folder-uid` - Filter by shared folder.

`ip-address`- Filter by IP Address.

**Examples:**

```sh
My Vault> audit-report --report-type day --created today --columns username ip_address
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Parameter:**

`-ReportType` - Type of report like `raw, hour, day, week, month, span, dim` .

`-Columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

`-Order` - Change the report list order `asc or desc` .

**Filters**:

`-Created` - Created filter like `today, yesterday, last_7_days, last_30_days, month_to_date, last_month, year_to_date, last_year` .

`-EventType` - Filter by event-type like `login, record_update` .

`-Username` - Filter by username.

`-ToUsername` - Filter by event's target.

`-RecordUid` - Filter by record.

`-SharedFolderUid` - Filter by shared folder.

`-IpAddress`- Filter by IP Address.

`-NodeId` - Filter with node

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport -ReportType day -Created last_7_days  -Columns username, ip_address -Order asc

username                          ip_address
--------                          ----------
test1@example.com                 10.5.12.58
Deleted User ID: -7               10.5.12.202
Deleted User ID: -8               54.157.148.5
test2@example.com                 10.5.11.246
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>

#### Audit Report Format

This command/function displays a list of reports output based on format like json, table, csv.

<details>

<summary>DotNet CLI</summary>

**Command:** `audit-report --report-type day --columns username ip_address --format json`

**Parameter:**

`report-type` - Type of report like `raw, hour, day, week, month, span, dim` .

`columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

`format` - Output format like json, table, csv.

**Examples:**

```sh
My Vault> audit-report --report-type day  --columns username ip_address --format json
```

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Get-KeeperAuditReport`

**Parameter:**

`-ReportType` - Type of report like `raw, hour, day, week, month, span, dim` .

`-Columns` - Column name `created, audit_event_type, username, ip_address, keeper_version, message, record_uid` .

`-Format` - Output format like json, table, csv.

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Get-KeeperAuditReport -ReportType day  -Columns username, ip_address -Format json
[
  {
    "username": "Deleted User ID: -6",
    "ip_address": null
  },
  {
    "username": "test1@example.com",
    "ip_address": "10.5.12.58"
  },
  {
    "username": "Deleted User ID: -6",
    "ip_address": null
  }
 ]
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/reporting-commands/audit-report-command.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.