Secret Server
Audit & Logging
Training Guide
A comprehensive reference for all logging capabilities within Delinea Secret Server — covering every log type, report option, and compliance strategy for auditors and security teams.
All Logging Options in Secret Server
Secret Server provides 14 distinct log streams. Click any card to expand full field details.
Secret Activity Logs — Deep Dive
The most-used audit log for compliance. Every interaction with a secret is captured and retained.
The Secret Activity Log is the per-credential audit trail and is accessible two ways: globally from the Reports menu and per-secret from the secret's Audit tab. It cannot be disabled for individual secrets when logging is enabled platform-wide.
| Characteristic | Detail |
|---|---|
| Retention | Stored in Secret Server database; no automatic expiry — governed by your DB backup/retention policy |
| Granularity | Every access attempt, successful or failed, is logged with actor identity and IP |
| Access Required | View Own Audit, View Secret Audit (role permissions), or Administrator |
| Tamper Protection | Database integrity + SIEM forwarding recommended |
| Export Formats | CSV, PDF (via browser print), API (REST/JSON) |
| Action Code | Description | Risk Level | Compliance Relevance |
|---|---|---|---|
| VIEW | Secret fields were viewed (password/username revealed) | HIGH | SOX, HIPAA, PCI-DSS |
| COPY | Password copied to clipboard | HIGH | SOX, PCI-DSS |
| EDIT | Secret fields were modified | CRITICAL | All frameworks |
| DELETE | Secret was deleted | CRITICAL | All frameworks |
| CHECKOUT | Exclusive check-out acquired | MEDIUM | SOX, NIST |
| CHECKIN | Check-out released (auto-password change may follow) | MEDIUM | SOX, NIST |
| LAUNCH | Launcher (RDP/SSH/Web) session initiated | HIGH | PCI-DSS 10, HIPAA |
| SHARE | Secret shared with additional user/group | HIGH | Least-privilege frameworks |
| EXPIRE | Secret was manually expired | MEDIUM | All frameworks |
| UNDELETE | Deleted secret was restored | HIGH | Change management |
| CONVERT | Secret type was converted | MEDIUM | Change management |
| ACCESS_DENIED | User attempted access but was denied | HIGH | All — alert-worthy |
Navigate to Reports
From the top navigation bar, go to Admin → Reports. The Reports dashboard lists all built-in report categories.
Select Secret Activity Report
Under the Secrets category, click Secret Activity. This provides a global view across all secrets you have permission to audit.
Set Date Range & Filters
Filter by date range, user, action type, and secret folder. For compliance reviews, set the period to match your audit window (e.g., last 90 days for PCI-DSS).
Per-Secret Audit Tab
Open any secret → click the Audit tab. This shows the full lifecycle history for that single credential. Ideal for incident investigation.
Export for Auditors
Click Export to CSV. Provide this file to external auditors or import into GRC tools. Date, user, action, and IP are all included.
Use the Secret Server REST API to programmatically pull Secret Activity data for automated compliance reporting:
System Logs — Platform Health & Configuration Events
System Logs capture the operational health and administrative changes to the platform itself.
User Audit Logs — Identity & Authentication
Tracks everything about how users interact with the platform, from login to role assignment.
| Event | What's Captured | Compliance Use | Alert Priority |
|---|---|---|---|
| Successful Login | Username, source IP, timestamp, auth method (local/AD/SAML) | Access tracking, time-of-access analysis | LOW |
| Failed Login | Username attempted, IP, failure count, lockout status | Brute-force detection, UEBA baseline | HIGH |
| Account Lockout | Account locked, by whom (system/admin), timestamp | Incident response, SOX access reviews | CRITICAL |
| MFA Event | Method (TOTP/DUO/YubiKey), success/failure, device ID | MFA enforcement proof for PCI-DSS 8.3 | MEDIUM |
| Password Reset | Target account, who reset it, method (self-service/admin) | Change management, audit trail | MEDIUM |
| Role Assignment | Role added/removed, principal, admin performing change | Privilege creep detection, SOD review | CRITICAL |
| Group Membership | Group added/removed, user, timestamp | Access control change tracking | HIGH |
| User Created/Disabled | New or disabled account details, creator | Onboarding/offboarding compliance | HIGH |
| Impersonation | Admin acting as another user, target user, actions taken | Privileged operation audit trail | CRITICAL |
Discovery Logs — Credential Coverage Evidence
Proves to auditors that your organization has scanned for and onboarded all privileged accounts.
Discovery logs answer the auditor question: "How do you know you've found all privileged accounts?" They provide scan scope, findings, and import decisions.
🖥️ Active Directory Discovery
🐧 Unix/Linux Discovery
🗄️ Database Discovery
☁️ Cloud Discovery
Session Recording Logs — Full Privileged Session Audit
Provides irrefutable evidence of exactly what was done during a privileged access session.
| Capability | Detail | Auditor Value |
|---|---|---|
| Video Recording | Full screen capture of RDP, web launcher sessions at configurable FPS | Non-repudiation for privileged desktop actions |
| Keystroke Logging | Every keystroke in SSH/Telnet sessions indexed and searchable | Search for specific commands across all sessions |
| Command Detection | Pattern matching to alert on dangerous commands (rm -rf, net user, etc.) | Real-time threat detection + retroactive investigation |
| Session Metadata | Start time, end time, user, target IP, protocol, session duration | Access timeline reconstruction |
| Session Termination Log | Who ended the session, normal vs forced termination | Incident response — was session forcibly ended? |
| Inactivity Detection | Auto-terminate idle sessions; logs when termination triggered | Proves automatic session timeout controls |
| Proxy Mode Log | Session Connector/SSH Proxy entries showing credential injection | Zero-knowledge credential usage proof |
Access & Authentication Logs
Platform-wide access control and authentication event stream.
Every API call to Secret Server is logged, enabling audit of automated integrations and scripts.
| Field | Description |
|---|---|
| token_id | OAuth2 token or SDK key identifier used |
| endpoint | REST endpoint called (e.g., /api/v1/secrets/{id}) |
| method | HTTP method: GET, POST, PUT, DELETE, PATCH |
| response_code | 200 OK, 401 Unauthorized, 403 Forbidden, etc. |
| client_ip | Calling system IP address |
| duration_ms | Request processing time |
When SAML 2.0 / SSO is configured, authentication events are captured in both Secret Server and your IdP.
MFA enforcement logs provide proof that multi-factor authentication was required and used.
| MFA Provider | Log Detail Captured |
|---|---|
| TOTP (Google Auth / Authy) | OTP validation result, device enrollment status |
| Duo Security | Duo push/call/passcode method, device name, approval/deny |
| YubiKey (OTP/FIDO2) | Key serial/UID, validation server response |
| Email OTP | OTP sent timestamp, validated timestamp, IP |
| RADIUS | RADIUS server response, attribute pass-through |
IP Address Allowlisting can be enforced at platform, user, and secret level. All enforcement events are logged.
Additional Logging Types
Secret Server offers several more specialized logs for advanced scenarios.
Built-in Audit Reports (60+)
Secret Server ships with over 60 pre-built reports. Here are the most critical for audit & compliance.
| Report Name | What It Shows | Compliance Use |
|---|---|---|
| All Secrets by Folder | Complete inventory of all secrets with folder hierarchy | Scope documentation, inventory audit |
| Secret Activity (last 30 days) | All secret interactions in the period | Access review, anomaly detection |
| Expired Secrets | Credentials past their expiration date | Stale credential remediation |
| Secrets Without Heartbeat | Credentials with no automated validation | Unmanaged credential risk |
| Secrets Expiring Soon | Upcoming expirations in next N days | Proactive rotation planning |
| Secrets With No Folder | Ungrouped secrets lacking permission inheritance | Access control governance |
| Checkout Log | All check-out/check-in events with duration | Exclusive access audit, SOX |
| Secrets with Unlimited Check-Out | Secrets allowing indefinite exclusive access | Risk assessment for auditors |
| Report Name | What It Shows | Compliance Use |
|---|---|---|
| User Audit | All user activity across the platform | General access audit |
| User Role Assignments | Every user and their current platform roles | Privilege review, least-privilege audit |
| Users With No Last Login | Dormant accounts that have never authenticated | Dormant account remediation (SOX, CIS) |
| Users With No MFA | Accounts without multi-factor auth enabled | PCI-DSS 8.3 compliance proof |
| Secret Permissions by User | All secrets a given user can access | User access review (UAR) for SOX |
| Group Membership | All groups and their members | RBAC review, offboarding verification |
| Failed Login Attempts | Authentication failures by user and IP | Brute force detection, SOC alerting |
| Admin Users | All accounts with administrator-level roles | Privileged account review |
| Report Name | Key Columns | Frequency Recommendation |
|---|---|---|
| Secret Access by User (Top N) | User, Access count, Secret name, Last access | Monthly UEBA baseline |
| Bulk Operations Log | Bulk edits/deletes, actor, quantity affected | Weekly – high-risk actions |
| Password View Count by Secret | How often each secret's password was revealed | Quarterly access review |
| After Hours Access | Accesses outside defined business hours | Weekly SOC review |
| Session Recording Activity | All recorded sessions with metadata | Continuous / on-demand |
| Discovery Import History | What was found and what was onboarded | After each discovery scan |
| Workflow Approval Audit | Request, approver, decision, time-to-approve | Monthly governance review |
| Report Name | What It Shows | Why Auditors Care |
|---|---|---|
| Heartbeat Failures | Credentials where stored password doesn't match target | Proves automated validation is working |
| RPC Failures | Failed automated password rotations | Rotation policy enforcement evidence |
| Inactive Secrets | Secrets not accessed in N days | Unused credential risk — candidates for retirement |
| Engine Health | Distributed Engine status, last contact | Platform reliability and coverage gaps |
| Session Recording Storage | Storage utilization and retention status | Evidence of recording capability |
Secret Server supports fully custom SQL-based reports. Compliance teams can write targeted queries against the SS database to produce any custom evidence required by auditors.
Compliance Framework Mapping
Map Secret Server log types to specific requirements across 8 major frameworks.
🏦 PCI-DSS v4.0
- Req 8.2–8.3: User & MFA logs prove unique IDs and MFA enforcement
- Req 10.2: Secret Activity + Session Recording satisfies activity logging
- Req 10.3: Protect audit logs — forward to write-once SIEM
- Req 10.6: Retain logs ≥ 12 months, 3 months immediately available
- Req 12.3: Risk assessments supported by Discovery and Heartbeat logs
⚕️ HIPAA Security Rule
- §164.312(b): Audit controls — Secret Activity and User Audit logs
- §164.312(c): Integrity — immutable log storage with SIEM forwarding
- §164.312(d): Authentication — User Audit and MFA logs
- §164.312(e): Transmission security — API and session logs
- Minimum necessary access — Access Request workflow log
📑 SOX (IT Controls)
- Access reviews: User Role Assignment + Secret Permissions reports
- Change management: Configuration Audit + Template Audit logs
- Segregation of duties: Role Assignment alerts + Workflow log
- Privileged access: Secret Activity (VIEW/EDIT/DELETE) + Checkout log
- Evidence retention: Export reports quarterly for walkthroughs
🔐 NIST SP 800-53
- AU-2/AU-3: Audit events — all 14 log types satisfy event coverage
- AU-9: Protect audit info — SIEM forwarding + immutable storage
- AU-12: Audit record generation — SS logs with timestamps
- IA-2: MFA — User Audit + MFA event logs
- AC-6: Least privilege — Role + Permission audit logs
🌐 ISO/IEC 27001
- A.9 (Access Control): User Audit, Role Assignment, Permission logs
- A.12.4 (Logging): All log types cover monitoring requirements
- A.12.4.3: Admin & operator logs — System Log + User Audit
- A.16 (Incidents): Session Recording + Event Pipeline for IR
- A.18 (Compliance): Reports + compliance mapping documentation
🏛️ CIS Controls v8
- CIS 5 (Account Management): User Audit + discovery logs
- CIS 6 (Access Control): Role + Permission + Request logs
- CIS 8 (Audit Log Management): SIEM pipeline + retention policy
- CIS 12 (Network Monitoring): Session Recording proxy logs
- CIS 18 (Pen Testing): Discovery + Heartbeat failure reports
💳 SWIFT CSP (CSCF)
- 5.1 Logical Access Controls: User Audit + Role Assignment logs
- 6.1 Operator Security: Session Recording for all operator sessions
- 6.2 Software Security: Config Audit log for change evidence
- 6.5A Defense Against Cyber Attacks: Event pipeline to SIEM
- 7.1 Vulnerability Scanning: Discovery log coverage
🗝️ FedRAMP / FISMA
- AU family: All 14 log types map to AU control family
- AC-17: Remote access — Session Recording + API access logs
- IA-8: MFA for non-org users — MFA and SAML logs
- SI-4: System monitoring — SIEM pipeline from event log
- CM-3: Change control — Configuration Audit log
SIEM Integration — Real-Time Log Forwarding
Forward all Secret Server events to your SIEM for centralized, tamper-resistant storage.
Enable Syslog in Secret Server
Go to Admin → Configuration → Application Settings. Enable Syslog/SIEM. Set the SIEM server IP, port (typically 514 UDP or 6514 TCP/TLS), and format (CEF, LEEF, or Generic syslog).
Choose Log Format
CEF (Common Event Format) for Splunk, ArcSight, QRadar. LEEF (Log Event Extended Format) for IBM QRadar native. Syslog RFC 5424 for generic SIEM parsers. Delinea also supports JSON over HTTP webhooks for cloud SIEMs (Sentinel, Chronicle).
Select Events to Forward
All events can be forwarded. For targeted alerting, configure event subscriptions: Secret Access, User Auth, Admin Actions, Config Changes, Session Events. Navigate to Admin → Event Subscriptions to map events to notification rules.
Verify Delivery & Set Retention
Check the Event Pipeline Log for delivery confirmation. In your SIEM, set retention to match your compliance mandate — minimum 12 months for PCI-DSS, 6 years for HIPAA records. Archive to cold storage after primary retention period.
Example CEF event for a Secret VIEW action:
These are the highest-priority SIEM alert rules to configure for Secret Server events:
| Alert Rule | Trigger Condition | Priority |
|---|---|---|
| Mass Secret Access | >20 secret views by 1 user in 5 min | P1 |
| Admin Role Granted | Any Administer Users or Unlimited Admin role assigned | P1 |
| Configuration Weakened | Security config change that reduces restrictions | P1 |
| Secret Bulk Delete | >5 secrets deleted in a single session | P1 |
| After-Hours Privileged Access | Secret VIEW/EDIT outside 08:00–18:00 local | P2 |
| Authentication Brute Force | >5 failed logins in 10 min from same IP | P2 |
| Discovery Scope Reduction | Discovery scanner range reduced or disabled | P2 |
| Heartbeat Engine Down | Heartbeat background thread Error/Fatal in system log | P2 |
| Session Recording Disabled | Session recording policy changed to off | P1 |
| MFA Bypass | Bypass MFA role granted to any account | P1 |
Auditor Best Practices
Proven strategies for leveraging Secret Server audit logs during compliance assessments and investigations.
Establish Log Forwarding Before the Audit Period Begins
Ensure SIEM forwarding is configured before audit scope periods start. Auditors often request 90-day or 12-month windows. Logs only in the SS database are subject to database access restrictions; SIEM copies are independent of SS access and provide tamper-evidence.
Run User Access Reviews (UARs) Quarterly
Use the Secret Permissions by User and User Role Assignments reports. Export to CSV and have business owners certify that each user's access level is appropriate. This directly satisfies SOX and ISO 27001 A.9 periodic access review requirements.
Enable and Enforce "Reason Required" Comments
Configure Secret Policies to require a comment/reason when viewing privileged passwords. This adds the Notes field to every Secret Activity log entry — turning raw access logs into meaningful audit evidence with business justification attached to each access event.
Use the Checkout Workflow for High-Risk Secrets
Exclusive checkout means only one user can hold a privileged credential at a time. The Checkout Log provides precise timestamps of who held each credential and for exactly how long — ideal for change-window accountability required by SOX and ITIL change management.
Document "Unmanaged Account" Discovery Findings
Run Discovery scans before audits and export the Discovery Import Report. Accounts found but not onboarded must have documented business justification. This satisfies auditor questions about PAM scope and provides evidence that all privileged accounts have been identified.
Schedule Critical Reports to Auto-Email
Schedule Heartbeat Failures, Expired Secrets, and Users With No MFA to email the security team weekly. This demonstrates continuous monitoring rather than point-in-time snapshots, which is specifically required by frameworks like NIST 800-53 CA-7 (Continuous Monitoring).
Preserve Session Recordings for the Full Retention Period
Configure the Session Recording Server's retention policy to align with your longest compliance mandate. PCI-DSS requires 12 months; HIPAA requires 6 years. Use tiered storage: hot storage for 90 days (immediate playback) + cold archive for the remainder. Recordings are your strongest non-repudiation evidence.
Test Log Completeness Regularly
Periodically perform test accesses (view a test secret, trigger a failed login) and verify those events appear in both the SS UI and the SIEM within expected latency. This proves to auditors that logging is actively functioning, not just configured. Document these tests as part of your continuous monitoring program.
Audit Readiness Checklist
Click each item to mark it complete. Use this before every compliance audit.
Category: Log Infrastructure
Category: Access Review Evidence
Category: Credential Management
Category: Evidence Packages for Auditors