Question:
How to determine when a user Account is added to Vault?
Answer:
A search of the system audit log indicates when a user is created. Export the results as a text or .csv file for the timeframe desired. Once exported, filter on the Action column for the action of Create.
There are four associated field names when creating users:
- Active
- License Type
- User Type
- Security Policy
To find a specific user, filter on the Item column for the specified username.
Note: The System Audit logs are limited to 2-week blocks of time. If the timeframe is greater, perform multiple exports to cover the desired date range.
Related Documentation:
Vault Audit Log Documentation: Viewing Admin Logs