---
title: Run Security Audit Compliance Reports
slug: kronpam-how-to-guides-180/run-security-audit-compliance-reports
description: Learn how to generate comprehensive security audit compliance reports with Kron PAM. Discover insights into logging and user activities such as SSH/TELNET, remote desktop, secure file transfer, database, and web sessions. Gain understanding of password ch
docTags: 
createdAt: 2022-08-18T16:51:44.000Z
---

Organizations require security audit reports to maintain internal control and perform audits, in accordance with multiple standards, such as the Sarbanes-Oxley Act (SOX). For these audit and transparency purposes, Kron PAM provides detailed security audit compliance reports. This document describes how to run these reports.

# Security Audit Compliance Reports

## Logging Activity

Most audit reports require logging user access attempts to the system. Kron PAM allows you to monitor the log-in activities of privileged users.

Kron PAM records **Login**, **Logout**, and **Login** **failure** activities in detail, including time and source for SFTP, GUI(UI), TACACS+, RADIUS, and SSH connections, as well as the reasons for Login Failure.

To access the **User Authentication** reports:

1. Navigate to **Logging** > **User Auth. Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format              

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/K9zW-hmd2MPeCHQ2AU9n7_image.png)

## User Activity

User actions are recorded by Kron PAM so that important data for audit reports, such as which user did what and when can be reported as well.

### SSH/TELNET Session Command Line Interface Activity

The Kron PAM Session Manager tracks Command Line Interface (CLI) operations performed during privileged sessions. User, Target Server, Session Start Date, and Session End Date logs are available in the Session Log field of the Kron PAM Web GUI.

To access the **Session Logs** Reports:

1. Navigate to **Logging** > **Session Log** > **Session Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/wSaC_PfBPFhFs_rqhI1YK_image.png)

Session log reports, including who did what in privileged sessions, satisfy SOX compliancy requirements. The **Commands executed by user** logs recorded for SSH/TELNET sessions are also logged in the Command Logs section.

To access the **Command Detail** reports:

1. Navigate to **Logging** > **Session Log** > **Command Logs**
2. Select Report Filters and click the Search button
3. Click Export Data to Excel to get the report in Excel format

### Remote Desktop (RDP/VNC) Session Activity

The Kron PAM Session Manager tracks RDP/VNC operations performed during privileged sessions. User, Target Server, Session Start Date, and Session End Date logs are available in the Session Log field of the Kron PAM Web GUI.

To access the **Session Logs** reports:

1. Navigate to **Logging** > **Session Log** > **Session Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/U0P6IVIV1wX_l3l96xStN_image.png)

The **Session logs** reports, including who did what in privileged sessions, satisfy SOX compliance requirements. Text captured by the optical character reader (OCR), and keyboard and mouse movements for RDP sessions, are also logged in the Command Logs section.

To access the **Command Detail** reports:

1. Navigate to **Logging** > **Session Log** > **Command Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/JCHMZW_I_XttJ_LN1Sqo-_image.png)

### Secure File Transfer Session (SFTP) Activity

The Kron PAM Session Manager tracks File Transfer operations performed during privileged sessions. User, Target Server, Session Start Date, and Session End Date logs are available in the Session Log field of the Kron PAM Web GUI.

To access the **Session Logs** reports:

1. Navigate to **Logging** > **Session Log** > **Session Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ohGvKymFYs4PiklqIRaB2_image.png)

Session log reports, including who did what in privileged sessions, satisfy SOX compliance requirements. The **Commands executed by user** logs recorded for SFTP sessions are also logged in the Command Logs section.

To access the **Command Detail** reports:

1. Navigate to **Logging** > **Session Log** > **Command Logs**
2. Select **Report Filters** and click the Search button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/lJfvJjoFAvNmGcDZZ1PZI_image.png)

### Database (SQL) Session Activity

The Kron PAM Session Manager tracks Database operations performed during privileged sessions. User, Target Server, Session Start Date, and Session End Date logs are available in the Session Log field of the Kron PAM Web GUI.

To access the **Session Logs** reports:

1. Navigate to **Logging** > **Session Log** > **Session Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/fQXQItCxbmOhpjQPxwJtk_image.png)

Session log reports, including who did what in privileged sessions, satisfy SOX compliancy requirements. The “Commands executed by user” logs recorded for SQL sessions are also logged in the Command Logs section.

To access the **Command Detail** reports:

1. Navigate to **Logging** > **Session Log** >**Command Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Y-ITBxLdjHwIz8QDUS4Ig_image.png)

### Web Session (HTTP/S) Activity

The **Request URL of User** data is logged via the HTTP Proxy component of Kron PAM.

To access the **HTTP Proxy Log** reports:

1. Navigate to **Logging** > **HTTP Proxy Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/u-NyC6afGadmezSNIU40C_image.png)

### Password Checkout Activity

The Kron PAM Password Manager module provides one of the “User Activities” reports, which includes the users’ password checkout activities for device connections.

To access the **Password Change Log** reports:

1. Navigate to **SAPM Management** > **SAPM Management** > **Password Change Log**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/XJ71gk1B3a5Lq4CvlIHc-_image.png)

### Device Administration Activities (TACACS+, RADIUS)

### TACACS+ Account Log

The *Commands executed by user* logs recorded for TACACS+ connections are available from the TACACS+ Account Log section of the Kron PAM Web GUI. These logs can be used as one of the **User Activities** reports.

To access the TACACS Account reports:

1. Navigate to **Logging** > **Tacacs Account Log**
2. Select **Report Filters** and click the **Search **button
3. Click **Export Data to Excel **to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/YmsHhtdotAP29D06a-cdU_image.png)

### RADIUS Account Log

Accounting and authorization activities are logged for RADIUS connections. These logs can be used as one of the **User Activities **reports.

To access the **RADIUS Account** reports:

1. Navigate to **Logging** > **Radius Account Log**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ohWEXHHXY6APklQGhvi2b_image.png)

### Kron PAM UI Activities

All user activity on the Kron PAM Web GUI is recorded. In the UI Activities section, reports can be run for various activities, such as adding/deleting devices, defining users, and searching records.

To access the **User Activities** reports:

1. Navigate to **Logging** > **Activity Logs**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/BvXXwm-Ukpo6v1ckfasIz_image.png)

Some of the “Event Types” are listed below:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/YRPxtAN5ZNN9LyOz5kORN_image.png)

## Access Controls

Policy enforcement is a major part of security requirements. Kron PAM knows which systems users can access, and what they are allowed to do on these systems. The Policy tracking function is useful for access control reports of auditing reports.

Authentication logs provide visibility into which users can access which devices; Authorization logs show which activities are authorized (whitelisted) or unauthorized (blacklisted) for which users are on the devices they are allowed to connect to.

To access the **Authorization** reports:

1. Navigate to **Policy Control** > **Policy Tracking** > **Authentication**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Ry2OCMCwsKB6qU8F-rW2x_image.png)

To access the **Authentication** reports:

1. Navigate to **Policy Control** > **Policy Tracking** > **Authorization**
2. Select **Report Filters** and click the **Search** button
3. Click **Export Data to Excel** to get the report in Excel format

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/YOXvXLxAmLhomQfrG1xhX_image.png)

## Report Security

All logs and records are kept in a database, in binary format. The database access is restricted by the DB admin.

Sensitive data in the logs is encrypted with a customer-specific master key and data encryption key. All the data is hashed and checked regularly for data integrity.