Administration
CipherTrust Manager Administration
- CipherTrust Manager Release Model
- Supported Upgrade Paths
- Authentication
  - Authentication Settings for NAE, KMIP, Web, and Preboot Interfaces
  - Users
  - Certificate Based Authentication for Users
  - Managing Your Own User Account Settings
  - Authentication Tokens
  - Client Management
  - Authenticating to the REST API
- Attribute-based Access Control Permissions for Resources
  - Backup
  - Certificate Authority
  - Client Management
  - Cluster
  - Keys
  - Connection Managers
  - Proxies & Allowed Proxies
  - DNS Hosts
  - Domains
  - Groups & Groupmaps
  - Interfaces
  - Connections
  - Logs
  - Log Forwarders
  - Quorum
  - Records
  - Users
  - Scheduler
  - Servers
  - SNMP
  - Policies
  - Migrations
  - Licensing
  - HSM
  - Miscellaneous
  - Network
  - ProtectApp
  - Secrets
- Password Policy
- Key Policies
- Changing Passwords
- Domain Management
- Groups
- Group Mapping
- Services
- Root of Trust Hardware Security Module
- Clusters and Nodes
- CipherTrust Manager System Monitoring
  - Records
  - Alarms
  - Syslogs
  - Debug Logs
  - Log Forwarding
  - Prometheus Metrics Endpoint
- Policies
- Banners
- Basic Interface Configuration
- Proxy Configuration
- Quorums
- SNMP
- SMTP
- Backups
- Scheduling Backups
- Disk Encryption After Initial Deployment
- Scheduler
- Connection Manager
  - Connections
  - Labels in Connection Manager
  - AWS
  - Google
  - Secure Copy Protocols (SCP/SFTP)
  - Azure
  - Hadoop Knox
  - Loki
  - Salesforce
  - Luna Network HSM
  - Elasticsearch
  - SAP Data Custodian
  - CIFS/SMB
  - Syslog
  - Oracle Cloud Infrastructure
  - DSM Connection
  - OIDC
  - LDAP
  - Attestation Authority Connection
  - CM Connection/External CM
    - Managing CM Connections using GUI
    - Configuring CM Connections using ksctl
  - Akeyless Gateway
- Browsing LDAP Users and Groups
- System Upgrade/Downgrade
- Configuring DNS Hosts
- CLI Toolkit
  - CLI Toolkit Installation
  - Batching Commands with Tokens
  - Example CLI User Set Up
  - Support CLI
- Keys
- Key Rotation
- Crypto Operations
- MKEK Rotation
- Certificate Authority
- System Info
- System Properties
- Network Diagnostics
- Integrating Logging with Splunk App
- Return Material Authorization (RMA) Guidance
- Secrets Management
- Reports
- Key Templates
Application Data Protection
- Interfaces
- Managing DPG Configurations
  - Managing DPG Applications
- Managing CRDP Configurations
  - Managing CRDP Applications
- Managing CDP for Teradata VantageCloud Lake Configurations
  - Managing CDP for Teradata VCL Applications
- Managing CADP for Java Configurations
  - Managing CADP for Java Applications
- Managing BDT Configurations
  - Managing BDT Applications
  - Managing Data Sources
  - Managing Job Configuration
    - Running Job from Application
    - Running Job from Job Configuration
  - Job Status
- Managing Character Sets
  - Creating character set
  - Deleting character set
- Managing User Sets
  - Viewing user sets
  - Creating user sets
  - Deleting user sets
- Managing Masking Formats
  - Viewing masking format
  - Creating masking formats
  - Deleting masking format
  - Modifying masking format
- Managing Access Policy
  - Viewing access policy
  - Creating access policy
  - Modifying access policy
  - Deleting access policy
- Managing Protection Policy
  - Viewing protection policy
  - Creating protection policy
  - Modifying protection policy
  - Deleting protection policy
  - Protection Policy Versioning
  - IV for FPE/AES
  - Key States
  - Tweak algorithm and tweak data compatibility details
- Tasks
  - How to delete stale clients
  - View updated status of clients
  - Auto Renewal of Client Certificates
  - Fetch Latest Data from CipherTrust Manager
- Heartbeat Configuration
- Single Pane of Glass
Batch Data Transformation (BDT)
- Protection Profiles
- BDT Policies
- BDT Containers
CipherTrust Cloud Key Manager (CCKM)
- Overview
- AWS Resources
  - Managing AWS Accounts
  - Managing AWS Keys
  - Scheduling Operations
  - Managing AWS Reports
  - Managing Policies
  - Managing AWS Templates
  - Migrating to IAM Roles Anywhere Connections
  - Downloading AWS Metadata
- AWS CloudHSM Key Store Resources
  - Managing an AWS CloudHSM Key Store from CCKM
- AWS External Key Store Resources
  - Managing External Key Store Resources
  - AWS XKS Performance Summary
- Azure Resources
  - Prerequisites
    - Prerequisites for Azure Cloud
    - Prerequisites for Azure Stack Cloud with Azure AD
    - Prerequisites for Azure Stack Cloud with Azure ADFS
  - Managing Azure Vaults
  - Managing Azure Keys
  - Managing Azure Certificates
  - Managing Azure Secrets
  - Scheduling Operations
  - Managing Azure Reports
  - Viewing Azure Subscriptions
  - Performance Summary
  - Allowing AD Users to Manage Azure Vaults
  - Configuring Connection to Azure Using Private Link
  - Downloading Azure Metadata
- Microsoft Double Key Encryption (DKE) Resources
  - Managing DKE Endpoints
  - Managing DKE Authorized Tenants
  - Microsoft DKE service performance summary
- External CipherTrust Resources
  - Managing External CipherTrust Domains
  - Managing External CipherTrust Keys
- DSM Resources
  - Managing DSM Domains
  - Managing DSM Keys
  - Scheduling Operations
- Google Cloud Resources
  - Google Cloud Projects
  - Google Cloud Key Rings
  - Google Cloud Keys
  - Google Cloud Reports
  - Scheduling Operations
  - Downloading Google Metadata
  - Performance Summary
- Google Cloud External Key Manager Resources
  - Managing Google EKM Endpoints
  - Managing Google EKM Endpoint Policies
  - Google EKM Performance Summary
  - Managing Google EKM Cryptospaces
  - Managing Google EKM Cryptospace Endpoints
- Google Workspace CSE Resources
  - Access Policies
  - High Level Architecture
  - Licensing
  - Prerequisites
  - Communication with KACLS
  - CSE Guest Access Support for Google Meet and Google Drive
  - Google CSE support for Google's end-to-end encrypted email
  - Clustering for Google Workspace
  - Encrypting Data Encryption Keys
  - Decrypting Data Encryption Keys
  - Endpoints
  - Identity Providers
  - Viewing Google Workspace CSE Records
  - Performance Summary
    - Google Calendar
    - Google Drive
    - Google Meet
    - Gmail
- Key Material Export and Upload
- Luna HSM Resources
  - Managing Luna HSM Partitions
  - Managing Luna HSM Keys
  - Scheduling Operations
- Oracle Cloud Resources
  - Managing Oracle Vaults
  - Managing Oracle Keys
  - Managing Oracle Tenancies
  - Scheduling Operations
  - Managing Oracle Reports
  - Managing Oracle Compartments
  - Downloading Oracle Metadata
- OCI External Resources
  - Managing Identity Providers
  - Managing External Vaults
  - Managing External Keys
  - OCI EKMS Performance Summary
- SAP Resources
  - Managing SAP Groups
  - Managing SAP Keys
  - Scheduling Operations
  - Managing SAP Reports
  - Viewing Linked SAP Applications
  - Performance Summary
  - Downloading SAP Metadata
- SAP Hold Your Own Key (HYOK) Resources
  - Licensing
  - SAP HYOK endpoints
  - SAP HYOK keystores
  - Scheduling Operations
  - Performance summary
- Salesforce Resources
  - Managing Salesforce Organizations
  - Managing Salesforce Tenant Secrets
  - Scheduling Operations
  - Managing Salesforce Reports
  - Managing Salesforce Cache-Only Key Endpoints
  - Managing Certificates from Salesforce Organizations
- Migrate from CCKM Appliance
- Backup and Restore
CipherTrust Data Protection (CDP)
- Interfaces
- Concepts
- Configuring Oracle Databases
- Configuring DB2 Databases
- Configuring SQL Server Databases
- Configuring Teradata Databases
- Tasks
  - View Job History
  - Delete Views and Triggers
  - Create Views and Trigger
  - Delete Old Data
  - Create Domain Index
  - Encrypt a Column
  - Decrypt a Column
  - Configure Migration Server
- SSL Connection Over JDBC
  - SSL Connection Over JDBC for Oracle
  - SSL Connection Over JDBC for DB2
- Troubleshooting
CipherTrust Transparent Encryption UserSpace (CTE UserSpace)
- Overview
- Interfaces
- Concepts
- Data Transformation
- Managing Profiles
- Managing Clients
  - Client Settings
  - Changing Client Password
  - Managing Membership
  - Deleting Clients
  - Collecting Agent Information
  - Fetching Latest Capabilities from Clients
- Managing Client Groups
- Managing Signature Sets
- Managing Policies
  - Creating Policy Elements
  - Viewing Policy Elements
  - Creating Policies
  - Modifying Policies and Rules
- Managing GuardPoints
  - Considerations Before Creating GuardPoints
  - Creating GuardPoints
    - Creating Standard GuardPoints
  - Automatic and Manual GuardPoints
  - Viewing GuardPoints
  - Viewing GuardPoint Status
  - Removing GuardPoints
  - Disabling GuardPoints
  - Enabling GuardPoints
- Sharing Resources Across Domains
- Multifactor Authentication
- Communication with CipherTrust Manager
- Communication Workflow with CipherTrust Manager Behind a Load Balancer
- Configuring Cluster Node Preference
- Backup and Restore
- Integrating CTE Logging with Splunk
- Permissions
- Quorum Control
- Confidential Computing
- Load Balancer
- Operations
- Certificate Renewal
- Common Scenarios
- Reports
  - Clients Health Report
  - Clients Keys Report
  - Clients Profiles Report
  - Clients Policies Report
  - Policies Keys Report
  - GuardPoints Report
  - Clients GuardPoint Status Report
- Troubleshooting
- API Examples
  - Creating Keys
  - Creating Policy Elements
  - Creating Policies
  - Creating GuardPoints
- API Response Codes
- How to Configure the External CA for CTE
- How to Change Local CA or External CA for CTE
CipherTrust Transparent Encryption (CTE)
- Overview
- Interfaces
- Concepts
- Data Transformation
- Managing Profiles
- Managing Clients
  - Enabling Live Data Transformation
  - Setting Client Locks
  - Client Settings
  - CTE Linux Authentication and Client Settings
  - Changing Client Password
  - Managing Membership
  - Deleting Clients
  - Kernel Compatibility Matrix
  - Collecting Agent Information
  - Fetching Latest Capabilities from Clients
- Managing LDT Communication Groups
- Managing Client Groups
- Managing Signature Sets
- Managing Policies
  - Creating Policy Elements
  - Viewing Policy Elements
  - Creating Policies
  - Modifying Policies and Rules
  - Managing FAM Policies and Rules
- Managing GuardPoints
  - Secure Start GuardPoints
  - Considerations Before Creating GuardPoints
  - Creating GuardPoints
    - Creating Standard GuardPoints
    - Creating LDT GuardPoints
    - Creating Cloud Object Storage GuardPoints
    - Creating IDT GuardPoints
    - Creating Ransomware Protection GuardPoints
  - Enabling Secure Start for GuardPoints
  - Protecting Teradata Appliances
  - Automatic and Manual GuardPoints
  - Viewing GuardPoints
  - Viewing GuardPoint Status
  - Changing Designated Primary Set Connection
  - Changing SMB Connection
  - Removing GuardPoints
  - Disabling GuardPoints
  - Enabling GuardPoints
  - Enabling and Disabling MFA on GuardPoints
- Managing Kubernetes Storage Groups and Clients
  - Managing Kubernetes Storage Groups
  - Managing Kubernetes Clients
  - Protecting Kubernetes Clients
  - Collecting Kubernetes Agent Information
- Sharing Resources Across Domains
- Multifactor Authentication
- Communication with CipherTrust Manager
- Communication Workflow with CipherTrust Manager Behind a Load Balancer
- Configuring Cluster Node Preference
- Backup and Restore
- Integrating CTE Logging with Splunk
- Migrating CTE Configuration from Data Security Manager
- Migration Summary
- Permissions
- Quorum Control
- Confidential Computing
- Ransomware Protection
- File Activity Monitoring (FAM)
- Unique to Client Keys
- Load Balancer
- Operations
- Certificate Renewal
- Common Scenarios
- Reports
  - Clients Health Report
  - Clients Keys Report
  - Clients Profiles Report
  - Clients Policies Report
  - Policies Keys Report
  - GuardPoints Report
  - Clients GuardPoint Status Report
- Troubleshooting
- API Examples
  - Creating Keys
  - Creating Policy Elements
  - Creating Policies
  - LDT Use Cases
  - Creating GuardPoints
- API Response Codes
- How to Configure the External CA for CTE
- How to Change Local CA or External CA for CTE
Data Discovery and Classification (DDC)
- DDC overview
- Concepts
  - User groups
  - Locations
  - Information types
  - Classification profiles
  - Scans
  - Reports
  - Agents
  - Similarity search
- Discovering sensitive information
  - Local storage
  - Big data
    - Hadoop
    - Teradata
  - Network storage
    - NFS Share
    - SMB/CIFS Share
  - Server
    - Exchange Server
    - Sharepoint Server
  - Clouds
    - AWS S3
    - Azure Blobs
    - Azure Table
    - Google Workspace: GDrive
    - Google Workspace: Gmail
    - Office 365: Exchange Online
    - Office 365: OneDrive for Business
    - Office 365: SharePoint Online
    - Salesforce
  - Databases
    - IBM Db2
    - MongoDB
    - Microsoft SQL
    - MySQL
    - Oracle
    - PostgreSQL
    - SAP HANA
- Logging
- Operations
- Troubleshooting
- Appendix
- Deployment Security
ProtectFile
- Interfaces
- Client Profiles
- Clients
- Access
- Keys
- Rules
- Client-Rule Associations
- Network Shares
- Clusters
- Operations
- Migration from KeySecure Classic to CipherTrust Manager
- Migrating ProtectFile to CipherTrust Transparent Encryption
Secrets Management
- Configure Secrets Management
- Create and Protect Akeyless Secrets
- Configuring Hashicorp Vault Proxy with CSM
- Integrating External Secrets Operator (ESO) K8s plugin with CipherTrust Secrets Manager (Akeyless)
- CSM Integration with Luna Network HSM
- CSM Akeyless Gateway Version Files for CipherTrust Manager
- Managing Akeyless Gateway Versions for CSM
- Troubleshooting

Miscellaneous

Banners

Operations	Required Permissions
Get pre-auth banner	No permission needed
set pre-auth banner	UpdateLoginBanner
get post-auth banner	ReadPostAuthLoginBanner
set post-auth banner	UpdateLoginBanner

Alarms

Operations	Required Permissions
List alarms	ListAlarms
Clear alarms	ClearAlarms
Acknowledge alarms	AcknowledgeAlarms

Services

Operations	Required Permissions
Reset services	ResetServices
Restart services	RestartServices
Status of services	No permission needed

Templates

Operations	Required Permissions
List/Get templates	ReadKey
Create templates	CreateKey
Update template	UpdateKey UpdateKeyAppMeta
Delete template	DeleteKey

Properties

Operations	Required Permissions
List/Get properties	ReadProperties
Update properties	UpdateProperties
Reset properties	ResetProperties

Notifications

Operations	Required Permissions
List/Get email addresses	ReadEmailAddress
Add email address	AddEmailAddress
Delete email address	AddEmailAddress

Query Permissions

Operations	Required Permissions
Query permissions	No permissions needed

Links

Operations	Required Permissions
List/Get links	ReadLink
Create links	CreateLink
Update link	UpdateLink
Delete link	DeleteLink

Info

Operations	Required Permissions
Get system info	ReadSystemInfo
Set system info	UpdateSystemInfo

Identity Providers

Operations	Required Permissions
List identity providers associated with CM	No permission needed
Login (post)	No permission needed
Login (Get)	No permission needed
oidc-callback (post)	No permission needed

Disc Encryption

Operations	Required Permissions
Get encryption status of a server	No permission needed
Encrypt Server on next reboot	No permission needed

Crypto

Operations	Required Permissions
Format preserving encrypt	ReadKey,UseKey,EncryptWithKey
Format preserving decrypt	ReadKey,UseKey,DecryptWithKey
Encrypt	ReadKey UseKey EncryptWithKey
Decrypt	ReadKey UseKey DecryptWithKey
Re-encrypt	ReadKey UseKey EncryptWithKey DecryptWithKey
MAC	ReadKey UseKey MACWithKey
MAC verify	ReadKey UseKey MACVerifyWithKey
Sign	ReadKey UseKey SignWithKey
Sign verify	ReadKey UseKey SignVerifyWithKey
Encryptonite	ReadKey UseKey EncryptWithKey
Decryptonite	ReadKey UseKey DecryptWithKey
Generate Hash	No permission needed
Random	No permission needed

Suggest A Change

Miscellaneous

Banners

Alarms

Services

Templates

Properties

Notifications

Query Permissions

Links

Info

Identity Providers

Disc Encryption

Crypto

On this page