History of exposure¶

The History of exposure module keeps a trace of the password consultations performed on managed accounts: each time an administrator displays the current password of an account, an entry is created, together with the rotation it triggers. This page lets an auditor search, filter and export those events, and check that every exposure was indeed followed by a password change.

A single entry while the rotation is pending

As long as the rotation triggered by an exposure has not been launched, displaying the password of the same account again does not create a second entry. The number of rows therefore reflects the number of distinct exposures, not the number of consultations.

Exposure grid¶

The list displays three columns, each grouping several pieces of information. Rows are ordered by descending exposure date and the headers are not sortable. The window footer carries the pagination and a selector for the number of rows per page (15, 25 or 50).

The "Exposure" column¶

This column describes the consultation itself. Its three lines carry no on-screen label: each one is identified by an icon.

Data	Description
Date and time	Timestamp of the exposure, formatted `dd/mm/yyyy - hh:mm` followed by the time zone.
Administrator	Account that displayed the password, followed by their authentication domain.
IP address	Workstation the consultation was made from.

The "Details of the exposure" column¶

This column describes the managed account concerned.

Label	Data
User	Name of the exposed managed account.
Domain	Domain of the managed account.
Type	Local account or Service account. Displayed only in the Systancia Access password vault mode.

The "Renewal" column¶

Label	Data
State	Renewed if the password has changed since the exposure, Pending otherwise.
Renewal date	Date and time scheduled for the rotation. It is computed at exposure time, by adding the renewal delay configured for the platform.
Lifetime of old password	Number of days elapsed since the last password change, at the time of the exposure.

If the last rotation attempt failed, the state is displayed in red, as <reason>, still pending:

Reason displayed	Cause
Internal error occured	Error raised on the platform side.
Error received	Error returned by the target.
Gateway availability problem	No Edge Gateway could be used to reach the target.
Missing remote target	The target on which to change the password was not found.
Permissions problem occured	The password change was refused on the target.
Remote authentication error occured	Logging on to the target failed.
Network error occured	Network error during the operation.
Unknown error occured	None of the cases above.

Filters¶

A Filters panel, collapsed by default, sits at the top of the window. It gathers two blocks, which combine.

The "Exposure" block¶

Filter	Description
Exposure starting date	Start of the interval. Seven days before the current date by default, and cannot be later than it.
Exposure ending date	End of the interval. Current date by default; can be neither earlier than the starting date nor later than the current date.
Target user	List of the managed account names already exposed. All by default.
Target domain	List of the domains of those accounts. All by default.

The "Renewal" block¶

Filter	Description
Renewal starting date	Start of the scheduled rotation interval. Seven days before the current date by default.
Renewal ending date	End of the interval. Current date by default.
State	All, Renewed or Pending.

What the State filter selects

The filter sorts exposures according to whether their rotation has been triggered, whereas the Renewal column shows whether the password has actually changed. The two can differ for as long as a launched rotation takes to complete.

Display applies the filters; Reset clears the form and reloads the full list.

CSV export¶

The Export button downloads the exposures matching the active filters as an exposure_history.csv file, whose fields are separated by semicolons.

The file starts with two header lines — Organization, followed by its name, then Exportation date, followed by the export timestamp — and two blank lines, before the column heading line:

Column	Data
Exposure date	Date and time of the consultation.
Domain	Authentication domain of the administrator.
User	Administrator who displayed the password.
Client IP	IP address of the consultation workstation.
Target domain	Domain of the managed account.
Target user	Name of the managed account.
Renewal date	Scheduled date of the rotation.
Lifetime (days)	Age of the password at the time of the exposure.

What the export does not contain

The renewal state and the rotation error reason are absent from the file: they are only visible in the grid. The number of exported rows is also capped by a platform-level limit.