Advanced configuration | PS

Secrets Safe is a secure solution for storing and managing secrets, files, credentials, and text in a controlled, auditable environment. Password Safe administrators can assign groups in BeyondInsight to safes. Each safe operates as an isolated space where users can securely manage secrets within that safe.

For more information about what Secrets Safe is and how to configure them, see Secrets Safe Overview , SecretSafe Configure and BeyondInsight Password Safe Secrets Safe FAQ

Secrets Cache is a lightweight proxy for the Password Safe API, providing high performance throughput for password requests and Secrets Safe secrets.If communication with Password Safe is lost, the last known good managed account credentials are served from the local cache, even if the associated request has expired.

For more information about Secrets Cache, see Secrets Cache.

Workforce Passwords is a secure enterprise credential storage feature within Password Safe that helps organizations manage employee access to business applications. Workforce Passwords discovers and vaults new credentials for users’ business applications into their personal secure folder. Once stored, users can inject these credentials into applications using the Workforce Passwords browser extension, available for Chrome, Edge, and Firefox.

For more information about Workforce Passwords, see Workforce Passwords.

When flagged by a Password Safe administrator, Active Directory and Entra ID accounts can leverage JIT capabilities by disabling these accounts when checked in to Password Safe.

ℹ️ The Disabled at Rest feature is only available for Active Directory (AD) and Entra ID accounts.

For more information about Disabled at Rest, see

.

Time-based one-time password (TOTP), is a type of two-factor authentication method that generates a temporary, unique passcode every 30 seconds.

For more information about TOTP, see Two-Factor Authentication Using TOTP.

SAML (Security Assertion Markup Language) is an open, XML-based standard that enables single sign-on (SSO) by allowing users to authenticate once with an identity provider (IdP) and gain access to multiple applications.This approach enhances the user experience, reduces password-related security risks, and simplifies administrative management.

For more information about SAML, see Configure SAML.

BeyondInsight can duplicate stored events within the Windows Application Log. This setting is available in the console on the Connectors page. It primarily allows BeyondTrust Discovery Scanner events with user-defined filters to be duplicated in the log so that a log monitoring or scraper tool can perform monitoring for critical events.

For more information about Event Forwarding, see Local Event Log Forwarding.

You can configure SNMP and syslog event forwarding settings from the Connectors page. Both protocols work for all data aggregated by BeyondInsight and Discovery Scanner.

SNMP allows an agent on a managed device to send unsolicited notifications to an SNMP manager about significant events. Unlike standard SNMP operations where the manager polls the agent for data, traps are pushed from the agent without a request, enabling faster event reporting and reduced network overhead.

For more information about SNMP Traps and event forwarding, see SNMP Trap and Syslog Event Forwarding.