Entreprise Vault - User

Quick start guide

The aim of this quick-start user guide is to present the main actions that users can perform with Enterprise Vault.

Onboarding

The administrators are in charge of creating user accounts first.
Two scenarios are possible:

Then, if the admins have enabled multi-factor authentication, users will have to perform enrolment on first authentication.

Finally, when accessing Enterprise Vault for the first time, users must define a master password, which will be required for each new data decryption.

Access to Enterprise Vault

To access their vault, users must perform 2 actions:

Available clients

These actions, followed by access to the data, can be carried out on 3 types of client:

Type of vaults

Users have access to two types of vault:

*Enterprise Vault has a recovery mode which, if activated, can give administrators access to personal secrets.

Personal vault: possible actions

Users can perform the following actions on their personal vault:

Shared vault: possible actions

Users can perform the following actions* on the shared vaults:

*Obviously, depending on the user's role in the shared vault, some of these actions will not be possible for users

Browser plugin: specific actions

Finally, some actions are specific to the browser plugins.
In fact, they enable more advanced integration with the browser, including:

Personal vault

As a reminder, you have access to two types of vault:

On this page, we'll deal with generic information about using Enterprise Vault, like the authentication, then focus on your personal vault.

For simplicity's sake, the screenshots are taken from the web client, but most of the actions described can be performed on mobile or plugin clients.

For more information on shared vaults and plug-ins, please consult the following documentations:

Account management

Authentication, lock & log out

To access to your vault, you must perform 2 actions:

When accessing the service for the first time, or during a reset procedure, you must first define a master password.

If a you have forgotten your master password, you can click "Get master password hint" to obtain the hint defined at the same time as your master password. 
The reset case will be dealt with later.

Lock => provide the master password
If once authenticated you refresh the page or clicks "Lock now", you will have to provide your master password again.

Log out => perform a complete authentication (login, password and master password)
If you click "Log out", you will have to perform a full authentication: login, password and master password.

image.png

Locking or logging out can also occur after a period of inactivity.

Manage your authentication secrets

There are 3 secrets linked to the authentication which can be managed: the password and 2nd factor for WALLIX ONE IDaaS, and the master password for Enterprise Vault.
Each one can be changed if you know the current secret, or reset if you don't.

Reset WALLIX ONE IDaaS password

If you don't have access to your previous password:

  1. Access your WALLIX ONE IDaaS dashboard (like your_company@trustelem.com)
  2. Click Forgot your password?
  3. Enter the captcha then click Ask your administrator for a reset code
  4. Your admin will provide a code or a link to reset your password, or a temporary password

Change WALLIX ONE IDaaS password

If you still have access to your previous password:

  1. Access your WALLIX ONE IDaaS dashboard (like your_company@trustelem.com) and log in
  2. Click your profile then Security parameters
  3. Click the icon at the end of the line Password
  4. Change your password

image.png

If you authenticate through your company Identity Provider (Microsoft, Okta...) then you can't change your password with WALLIX ONE IDaaS.

Reset WALLIX ONE IDaaS 2nd factor

If you don't have access and will not recover your previous 2nd factor (for example, if your phone is broken), contact directly your admins: they will generate a new enrollment link, for a new 2nd factor.

Ask for a temporary WALLIX ONE IDaaS 2nd factor

If you're temporarily unable to access your 2nd factor (for example, if you've forgotten your phone), you can request an rescue code.

  1. Access your WALLIX ONE IDaaS dashboard (like your_company@trustelem.com) and provide your login and password.
  2. On the 2nd factor page, click Use an alternative method then Ask for a rescue code
  3. Your admin will provide a code to perform the authentication

Change WALLIX ONE IDaaS 2nd factor

If you still have access to your previous 2nd factor:

  1. Access your WALLIX ONE IDaaS dashboard (like your_company@trustelem.com) and log in
  2. Click your profile then Security parameters
  3. If you didn't use multi-factor authentication to get here, you'll need to click the green button to verify your 2nd factor
  4. Click the button for a 2nd factor, then perform the enrollment
  5. Optionally, you can delete the previous 2nd factor

image.png

This feature can be disabled by your company.
If you don't have a button, then you have to contact your administrators and they will generate a new enrollment link.

Reset Enterprise Vault master password

If you don't have access to your previous master password:

  1. Go to your Enterprise Vault login page and click Start a password reset procedure

    image.png

  2. Define a 6 digits code, and don't loose it!
  3. Wait for the admins to validate your request: after that you will be notified by email
  4. Click the link on the email, then provide your code and define your new master password

image.png

This feature can be disabled by your company.
If you don't have the button Start a password reset procedure then there is no way to recover your account.
You must contact your administrators, who will create a new account, but all your personal secrets will be lost.
Before doing so, check if you can't find your master password, especially with the hint you can get by using  Get master password hint on the login page.

Change Enterprise Vault master password

If you still have access to your previous master password:

  1. Go to your Enterprise Vault app then Settings and Security
  2. Provide your current master password, then the new master password

You should check Also rotate my account's encryption key, doing that the keys used to crypt your items will be changed too during the process.

Preferences

Go to your Enterprise Vault app then Settings and Preferences

Purge the account

Go to your Enterprise Vault app then Settings and My account

From here you can:

These actions are definitive; no restoration is possible.

Items management

On your personal vault, you can create Items.
An Item is a secret, you want to protect and keep for yourself in your vault.

image.png

Create items

Create login items
Login items are identifier to authenticate on websites or other services

From this field, you can also generate a password, verify if the password has been exposed, or toggle character count

Create card items
Card items are credit card you want to store on your vault

Create identity items
Identity items are all the useful information about the people you want to keep. The identity may be for yourself or someone else.

Create secure note items
Secure note items are simple notes that you want to store in your vault.
They can be useful if you wish to store an item whose type is not the default one, for example for an attachment such as a certificate.

Manage existing items

After the creation, you can edit the item, but also perform new actions clicking the 3 dots at the end of each lines.

For login items, you can also copy the username, password and verification code (TOTP) using the 3 dots.

Also for login items, if you change the password, you can open the item and you'll find the previous password under the CUSTOM FIELDS, clicking Password history.

When an item is deleted, it is transferred to the trash. From here, the item can be restored or deleted permanently.

Folders

Folders are used to organize and easily retrieve items that belong together.
This means that these items will continue to appear in the list of all your personal items, but can be found by clicking on the folder name.

To add a folder, you just have to provide its name.

You can create a folder in another folder by specifying the name of the parent folder then /, in the name of the new folder.
For instance I can create the folder "Credit cards" under the folder "Private" using the name: "Private/Credit cards"

image.png

After the folder creation, you can:

Favorites

Favorite items are as useful as folders: they make it easier to find certain frequently-used secrets.

To add an item to favorites, edit it then click on the star at bottom right of the window.

To find favorites items, click on Favorites  on the FILTERS menu.

Search items

To search an item, you must use the FILTERS menu.

Basics research:

Don't forget to click All items if you wish to return to the complete list of your items.

Advanced research

Using the input Search my vault you can carry out more complex searches.
Here are some example:

Filters can also be concatenated: 

You can use the ~ character to indicate the number of characters that can be different from the filter: 

The * character can be used to replace variable character strings: 

Send management

The Send feature is able to generate secure links to let you share text or files with people who are not Enterprise Vault members.

It is not possible to share the Send directly from Enterprise Vault.
This tool only generates links.

image.png

Create Sends

Go on your Enterprise Vault app, then click Send then New Send.
From here you have to define:

Manage Sends

After the creation, here are the possible actions:

If a Send is disabled because of the access count or the expiration date, you have to edit their values if you want to enable it again.

Generator

The generator can be used to create new Identifier or new Password.

image.png

From Tools then Generator you can generate password or identifier, but more important, you can define the policy used for the generation.

Why is it important to remember this? Because you can generate a password from other places: when you create an item, when you use browser plugins... The generation will always be based on what you have defined on this page.

For passwords, you can define:

If you prefer, you can also generates Passphrases instead of passwords. In this case you have some very explicit options, and the result will be something like: "footless-banter-helper-directive-sedation-life"

By using the clock-shaped button at the bottom right of the page, you can retrieve the password history generate

For identifiers, you can choose to generate something based on your email address, or something random.

What is great with identifier based on your email address is that it uses alias, and most of the existing mail box are able to handle alias.

For instance, from "user@trustelem.com" it generates "user+uw4j19uk@trustelem.com".
And the user will be able to receive the email sent to "user+uw4j19uk@trustelem.com".

Import / export items

If you have already used another another, you can import its items into your Enterprise Vault space.
And if you wish to switch to another vault or make a backup of your items, you can export your personal items.

image.png

In Tools then Import/Export data, simply select the input or output format, then proceed with import or export..

When importing, you can also choose to create the new items in a specific location if you want to be able to find them easily.

Reports

You have 4 reports available for your personal vault.
They'll give you an idea of the security associated with your secrets.

image.png

Check that the passwords used are not present in lists of stolen passwords.

image.png

Check if you used the same password multiple time.

image.png

Check the strength of your passwords.

image.png

Check if you have URLs in login items, which use "http" format.

Shared vault

As a reminder, you have access to two types of vault:

On this page, we'll focus on your shared vaults.

For more information on personal vault and plug-ins, please consult the following documentations:

Manage shared vault

Create shared vaults

On the filter menu, you have a button to create a new shared vault:

image.png

You can also create shared vaults from the Shared Vault Console.

After providing the name, the shared vault is created and you are the default Owner.

Access shared vault items

When you are a shared vault member, the items for which you have a permission are displayed with your personal items.

image.png

Access the Shared Vault Console

If you are Admin or Owner of a shared vault, you can access to the Shared Vault Console using:

image.png

image.png

From here you can select your shared vault (MyTeam or MyTeamAdmin in the following example):

image.png

Rename shared vaults

From the Shared Vault Console then Settings and Shared vault info you can rename your shared vault.

Only the Owners can rename a shared vault.

Members

To add a shared vault member, you must have access to the Shared Vault Console then go to Members.

From here you can click Invite member. Then you have to:

If you don't know what a collection is, you should start by reading the documentation.

Roles & Permissions

In a shared vault, members can have one of three possible roles:

In combination, members have permissions on selected collections:

Only Owner can add new Owners

Admins and Owners can only manage members of collections for which they have Can manage permission

User can't delete item, whatever their permissions are because it's done through the Shared Vault Console

If a User / Owner / Admin create a new collection, he automatically has the Can manage permission

Collection management

Shared vault Owners have additional settings to manage rights in the Shared Vault Console then Settings and Collection management.

Purge & Delete

From the Shared Vault Console then Settings and Shared vault info you can delete or purge a shared vault.

Only the Owners can purge or delete a shared vault.

Purge shared vaults

All items and collections are deleted. Members remain untouched.

Delete shared vaults

The shared vault is completely deleted and cannot be restored.


Manage items

Add / Edit / Delete items

Most of the possible actions are described in the personal vault documentation:

We'll only deal with the specific shared vault features here.
But first, if you don't know what a collection is, you should read the documentation.

That said, here's a list of the specifics of managing items in a shared vault.

And voila! everything else is the same.

Searching for an item in the shared vaults works in the same way as searching for a personal item.

Import / export data

Importing or exporting data to a shared vault works in the same way as for the personal vault.

The only difference is the menu: Shared Vault Console > Settings > Import/Export data

Reports

Reporting on data in a shared vault works in the same way as for the personal vault.

The only difference is the menu: Shared Vault Console > Reports

Manage collections

A collection is the equivalent of a folder. But as well as organizing items, it also carries the notion of user permissions.
When you create a shared vault, there are 2 default collections:

What you can do with a collection depends on your permissions:

More information are available on the Members chapter

A collection can be created through the personal vault or through the Shared Vault Console.
You have to define:

Browser plugin

Browser plugins are available for Firefox and Chrome (with Edge extension).
To install them, log on to the web application, then click on Browser extension setup.

image.png

Rotation plugins allow you to do more or less everything that's possible via the web application, with the exception of 3 things:

For most applications, please refer to the personal vault documentation.
Here, we'll deal only with the specifics of the plugins.

Authentication

After the setup or a logout, you have to click Enterprise single sign-on.

The field bellow, Specify the base URL of your on-premises hosted WALLIX Vault installation, is only used if you have accounts on multiple WALLIX IDaaS subscription and allow to switch between them.

Then you will then need to provide your master password to access your items.

Settings

In the Settings tab, you'll find various categories for configuring how you want to integrate your plugin into your browser.

Account security

Other options are not useful.

Autofill

Autofill uses the website/URL parameter of an item and compares it with the browser URL to decide whether login should be automatically filled.

image.png

image.png

image.png

Notes:

Notifications

Vault

Appearance

About