Click Reports on the home page of the console.
Select the report from Built-In Reports.
The navigation pane displays the following information about each instance of the report.
|
Column |
Description |
|---|---|
|
Start Time |
Displays the date and time when the report started. NOTE:It displays the session start time as set in the Manager. |
|
End Time |
Displays the date and time when the report ended. |
|
User |
Displays the name of the user who issued the command. |
|
Host |
Displays the name of the host from which the command was issued. |
|
Run As |
Displays the name of the user who issued the command. |
|
Run Host |
Displays the name of the host who issued the command. |
|
Audit ID |
Displays the unique ID of the audit record. |
|
Command |
Displays the command that was executed. |
|
Authorized |
Displays whether the rule for this command is authorized. |
|
Capture |
Displays whether the rule for this command was captured as video or as keystrokes. |
|
Audits |
Displays Audit ID and the respective capture details. |
|
User Domain |
Displays the user domain of the user who issued the command. |
|
|
|
Disconnect Type |
Displays the date, time, and disconnect type: Manual or Automatic. |
NOTE:When second factor authentication is enabled through Advanced Authentication in Privileged Access Manager, a user requests some session and is prompted to select second factor authentication Chain (Example: Access Control permission has 'Secondary Authentication:yes') and successfully completes. Two duplicate Access Control sessions are audited in the Reporting Console with the same Audit ID. Authorized: No, Capture: Yes and Authorized: yes, Capture: yes. This is because of the time it takes to sync with the Advanced Authentication data.