10.4 Vault Reports, Report Authorizations & the Export Vault Data (EVD) Utility

10.4 Vault Reports, Report Authorizations & the Export Vault Data (EVD) Utility

Quick Answer: CyberArk exposes audit evidence through two very different channels. Inside the PVWA, nine built-in reports — Privileged Accounts Inventory, Applications Inventory, Privileged Accounts Compliance Status, Entitlement, Activity Log, Users, Safes, Owners List, and License Capacity — are generated by members of the PVWAMonitor group and saved into the Reports Safe, PVWAReports, which the PVWA creates automatically the first time a report runs. Outside the PVWA, the Export Vault Data (EVD) utility, ExportVaultData.exe, exports Vault data to TXT/CSV files or an MSSQL database so it can be consumed by third-party analytics. The governing rule for both: a report contains only what the user who generated it was already authorized to see.

---

The Nine Built-In PVWA Reports

Each report answers a different audit question, and each carries its own permission requirements.

Two of these deserve emphasis because candidates confuse them constantly. Privileged Accounts Inventory answers "what accounts exist?". Privileged Accounts Compliance Status answers "are those accounts actually being managed in line with policy — and when is the next change due?". An auditor asking whether rotation is working wants the Compliance Status report, not the Inventory.

License Capacity is the report to reach for when onboarding suddenly starts failing across the estate: it shows consumed versus maximum licenses per user type and object, which is frequently the real cause.

---

Configuring Who Can Run Reports

Reporting is governed by two parameters under Administration → Configuration Options → Reports:

• The reports group parameter specifies the group of users who can generate and manage reports. Its default value is PVWAMonitor. Members of PVWAMonitor can view the reports they generated and the reports shown on their My Reports page. Only users specifically granted the required permissions in the Reports Safe can see all generated reports.
• The Reports Safe parameter specifies the Safe where reports are saved. Its default value is PVWAReports, and the Safe is created automatically when the first report is generated — so on a freshly installed system the Safe legitimately does not exist yet.

The provisioning sequence an administrator follows is therefore short: add the user to the PVWA Monitoring group, have them open the Reports page and run a report, and the PVWA adds their account to the Reports Safe as part of that first run.

How Safe Permissions Limit Report Scope

This is the single most important reporting concept on the exam, and it is a security control rather than a bug:

Reports contain only the information that the user who generated the report is authorized to access. Any other information is excluded, regardless of the properties specified in the Reports parameters.

The practical consequences follow directly:

• Two auditors running the same report on the same day legitimately receive different row counts, because they are members of different Safes.
• Adding a user to PVWAMonitor does not widen what they can see; it only grants the ability to run reports at all. Scope is still bounded by Safe-level permissions.
• To produce a genuinely enterprise-wide compliance report, the generating identity must have visibility across the estate — which is why the documentation directs you to add the user to the Auditors group for a system-wide Privileged Accounts Compliance Status report.
• A "missing data" complaint about a report is almost never a reporting defect. It is a Safe membership gap on the generating user.

---

The Export Vault Data (EVD) Utility

The PVWA reports are designed for human consumption inside the portal. EVD exists to get Vault data out of CyberArk entirely, so it can be loaded into a SIEM, a data warehouse, a GRC platform, or a long-term archive.

The EVD utility enables you to create reports — such as a list of Safes or incoming requests — by exporting data from the Vault to TXT or CSV files, with each report saved in a separate file. It can also export to an MSSQL database by changing its target.

It is run from a command line as ExportVaultData.exe:

ExportVaultData \VaultFile="D:\ExportVaultData\Vault.ini" \CredFile="D:\ExportVaultData\auditor.cred" \Target=File \LogList="D:\ExportVaultData\loglist.txt"

That invocation creates a log activities report for the Vault defined in Vault.ini, connecting as the user identified by the auditor.cred credential file, and saves the output to loglist.txt.

Parameters and Output Types

Each \<OutputName>=<FileName> pair requests one export, and at least one output file must be specified. The available output types include SafesList, UsersList, GroupsList, GroupMembersList, OwnersList, FilesList, LogList, RequestsList, ConfirmationsList, LocationsList, EventsList, ObjectProperties, Italogfile (the system log), and MasterPolicySettings (Master Policy settings including exceptions).

Two EVD Errors Worth Recognizing

• ITACM012S — "Timeout has expired error when FilesList reporter executed." Occurs on large reports; the fix is to run the FilesList report with \BundleTransaction set to Yes.
• ITATS379E — "Authentication failure for User %s. Incompatible client version." The EVD utility and the Vault are not on the same version; upgrade both to the same major version.

EVD terminates automatically on any error and writes the error to its log file, named Log.txt by default and placed at the location given in \LogFile.

---

Choosing Between PVWA Reports and EVD