Prove CyberArk is working — first tool + proof field

1. Why “is it working?” is five questions

Operators collapse five failures into one sentence. The contractor is not a Safe member. Dual control is waiting on a confirmer. PSM never reached the target. The password on the box drifted from the Vault. The Privilege Cloud Connector dropped. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught the objects — Safe, platform, CPM rotate versus reconcile, PSM, dual control. Here you learn the five tools you actually open, in order, when someone asks you to prove CyberArk is working — or why they cannot check out the password.

Hero · vault, session, Safe

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you Change a healthy secret at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open Change / Reconcile until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Privilege Cloud Portal. If you cannot recite the proof field, you are not ready to Change anything.

5. Runbook Side A → B → C

Side A proves the person is allowed to see and retrieve the secret. Side B proves the session and the Action that hit the Safe. Side C proves the password still matches the target and the Connector is still talking. On a messy Sev-2, do them in this order until a field lights up.

Side A — Accounts View + Safe ACL (can they even retrieve?)

1. Open Accounts View as the failing identity’s authorized list

   Path: Privilege Cloud Portal → Accounts View (this is the default after sign-in). Official: View accounts and account details. Filter All accounts. If the contractor cannot see Finance-Windows / 18_finance_admin, they do not have List accounts on that Safe. There is no password to Change.

2. Read the grid columns that close an ACL ticket

   Status (dash = operational; icons = Disabled for passwords rotation, Locked, Platform inactive/deleted, Failed password management). Safe. Access request — a request waiting is dual control, not an outage. Address and Platform ID confirm you have the right object.

3. Open the Safe Members tab, not the Vault widget

   Path: Policies → Safes → select the Safe → Members. Official: Manage Safe members. You need View Safe Members to read this. Quote whether the user or their AD group is a member, and whether List accounts, Retrieve accounts, and Use accounts are checked. Use without Retrieve is a legal Connect that still cannot Show.

4. If Access request is populated, chase the confirmer

   Master Policy dual control + Safe permission Confirm requests. Access Safe without confirmation overrides the wait — that is a design exception, not a night-shift toggle. Audit codes 109 Get File Request, 37 Confirm Get File, 119 Reject Get File Request are the official trail.

Side B — Monitoring + Activity log (did a session happen, what Action?)

1. Open Monitoring, not Change

   Path: Privilege Cloud Portal → Monitoring. Official: Monitor sessions. The menu is hidden if there are zero recordings and zero sessions — that itself is data. Filter User + Target Address + date range. Session monitoring requires a PSM connector; SIA-only tenants do not get this grid.

2. Read the session properties that close a PSM ticket

   Administrator-configured columns typically include the user who initiated, start time, duration, Target Address, Connection Type. Play Video is the recording. No row + user swears they clicked Connect → look at audit 301 PSM Connect Failure, not a password Change.

3. Generate the Activity log and quote User, Safe, Action

   Path: Reports → Generate Report → Activity log (docs also call the same store User and Safe Activities). Default output fields: Time, User, Action, Safe, Target (account), Target Platform, Reason, Alert, RequestID, ClientID. Filter User + Safe + period.

4. Memorise the three night-shift Action codes

   295 Retrieve password. 300 PSM Connect. 301 PSM Connect Failure (Alert). Sibling CPM codes you will meet on Side C: 22 Verify, 38 Verify Failure, 24 Change, 57 Change Failure, 31 Reconcile, 60 Reconcile Failure. Unauthorized retrieve is 42 / 43 Retrieve File (Unauthorized).

Path:            Reports → Generate Report → Activity log
Filter:          User + Safe + period
Quote:           Time + User + Action + Safe + Target + Reason + Alert
Night codes:     295 Retrieve password
                 300 PSM Connect · 301 PSM Connect Failure
                 22 / 38 Verify · 24 / 57 Change · 31 / 60 Reconcile
If no 295:       they never retrieved — go back to Safe members

Side C — CPM Overview + System Health (is the secret true, is the Connector up?)

1. Read Last Verified before you touch Change

   Path: Accounts View → click the account → Overview. Official: Manage and reconcile account passwords. Last Verified is whether the password on the target equals the password in Privilege Cloud. Click Verify (needs Initiate CPM account management operations). CPM verifies in the next management cycle; the compliance indicator updates when it finishes.

2. Reconcile is the unsynchronized verb

   If Verify fails, the next official step is Reconcile on the same Overview Compliance Status pane — not a hopeful Change, and not “Change password only in the vault” unless you intend to split-brain the target. Reconcile uses the linked reconcile account. Change / Reconcile / Verify stay disabled until CPM finishes a reconcile. Operational Views filter: Scheduled for Change/Verification/Reconciliation, Successfully reconciled, Failed.

3. Then — and only then — open System Health

   Path: Privilege Cloud Portal → System Health → CPM and Accounts Discovery or PSM. Official: Monitor system health. Proof field is component user Connectivity Status Connected or Disconnected, plus (for PSM) the count of currently active sessions. Disconnected is usually network or App-user sync, not a Safe ACL. Restoring CPM uses the SyncComponentUsers utility; restoring PSM needs Support to reset the App user — you cannot do that from the dashboard tile.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only: ops@lab.example, contractor@lab.example, Safe Finance-Windows, account 18_finance_admin, target 10.20.0.18.

Proof · named field, then Closed

CEVD-01 — Prove the ACL (Accounts / Safe members)

01:42 · P2. New contractor authenticates to lab.privilegecloud.cyberark.cloud. Finance-Windows is invisible. Someone already “checked the Vault.” L1 drafted a Change on 18_finance_admin.

First tool: Accounts View as that user — empty for that Safe. Then Policies → Safes → Finance-Windows → Members.

Proof field: contractor@lab.example is not a member. Finance-Admins holds List + Retrieve + Use. The contractor was never added to the group. That is change-control — add the group (Manage Safe Members), do not Change the secret, do not reboot a Connector.

CEVD-02 — Prove the request (dual control, not a hang)

02:05 · P2. ops@lab.example can see the account. Show is waiting. Channel says “PVWA is stuck.” Someone wants Access Safe without confirmation flipped on the Safe.

First tool: Accounts View → Access request column, then the request details. Confirmers are Safe members with Confirm requests (level 1 / level 2 per Master Policy).

Proof field: request still open; audit 109 Get File Request at 18:04Z; no 37 Confirm Get File and no 115 Last Required Confirmation. That is a people queue. Chase the L1 confirmer. Disabling dual control is Master Policy / exception change-control, not isolate.

CEVD-03 — Prove the session (Monitoring + 301)

02:20 · P1. Finance on-call cannot RDP through PSM to 10.20.0.18. Vault tile green. L1 wants the password Changed “so PSM will work.”

First tool: Monitoring. Filter User = ops@lab.example, Target Address = 10.20.0.18, last hour. Grid is empty — or a zero-duration row. Session monitoring needs a PSM connector; if the tenant is SIA-only, this menu will not save you.

Proof field: Activity log 01:39Z · User ops@lab.example · Safe Finance-Windows · Action 301 PSM Connect Failure · Alert. There is a 295 one minute earlier — they retrieved, so the ACL is fine. A 301 after a 295 is a target / PSM path (NLA, AppLocker, connector) — not a Change. Factory lesson: Vault up ≠ authorized, and authorized ≠ connected.

CEVD-04 — Prove the secret (Last Verified / Reconcile)

02:40 · P2. Yesterday Connect worked. A local admin reset the password on 10.20.0.18 during a break-glass. Show still displays a value. Connect fails. L1 clicks Change twice.

First tool: Accounts View → 18_finance_admin → Overview.

Proof field: Last Verified failed at 01:12Z. Compliance Status = Failed password management. Activities show CPM Verify Password Failure (38). Status filter Failed lists the same object. Official next click is Reconcile (linked reconcile account 18_finance_reconcile), not another Change, and not “Change password only in the vault” — that writes a new Vault value and leaves the target still drifted.

CEVD-05 — Prove the Connector (System Health)

03:00 · P1. Every PSM session in the Pune site died after a 02:00 firewall change. Accounts View still lists accounts. Someone typed Sev-1 “Vault is down.”

First tool: System Health → PSM (and CPM and Accounts Discovery on the same dashboard).

Proof field: PSM App user Connectivity Status = Disconnected since 02:01Z. Active sessions = 0. CPM on the same Connector may also show Disconnected. Official restore is not a Safe member add and not a password Change. CPM: SyncComponentUsers on the Connector. PSM: Technical Support resets the App user; you rebuild psmapp.cred / psmgw.cred with CreateCredFile, then confirm the tile returns Connected. Also confirm 443 to *.privilegecloud.cyberark.cloud is not TLS-inspected — the Connector pins the CyberArk chain.

7. Traps + close-the-ticket proof

Sources

• CyberArk Docs — View accounts and account details (Accounts View; Status; Overview Compliance Status, Last Verified, Activities; Operational state filters)
• CyberArk Docs — Retrieve (display) the account password (Show / Copy; exclusive lock until release or MinValidityPeriod)
• CyberArk Docs — Manage Safe members (Policies → Safes → Members; List / Use / Retrieve accounts; Confirm requests; Access Safe without confirmation)
• CyberArk Docs — Create and manage Safes for access control
• CyberArk Docs — Manage and reconcile account passwords (Verify on Last Verified; Reconcile / Change on Compliance Status; vault-only Change)
• CyberArk Docs — Account check-out and check-in (exclusive access; Unlock accounts)
• CyberArk Docs — Release a checked-out account
• CyberArk Docs — Monitor sessions (Portal → Monitoring; User, Target Address, Connection Type; PSM connector required)
• CyberArk Docs — Configure session recording and audits
• CyberArk Docs — Generate and view reports (Reports → Generate Report)
• CyberArk Docs — Privilege Cloud report types (Activity log / User and Safe Activities)
• CyberArk Docs — Report filters (User, Safe, period)
• CyberArk Docs — Configure report settings (Activity log fields: Time, User, Action, Safe, Target, Reason, Alert, RequestID, ClientID)
• CyberArk Docs — Audit action codes (22/38 Verify, 24/57 Change, 31/60 Reconcile, 295 Retrieve, 300/301 PSM Connect)
• CyberArk Docs — View audits
• CyberArk Docs — Monitor system health (Connectivity Status; CPM / PSM App users; restore notes)
• CyberArk Docs — Check Privilege Cloud Connector functionality (Verify on Overview; System Health; PSM service)
• CyberArk Docs — Switch between the primary and DR CPMs (Portal → System Health → CPM and Accounts Discovery)

Related: Blog 1 · CyberArk session factory — Vault up ≠ authorized · Privilege Cloud implementation · CyberArk practice dashboard