Active Administrator 8.7 - User Guide

Creating an alert history report

Creating an alert history report

To create an alert history report

1	Select Auditing & Alerting | Alerts.

2	Select Alert History | Report.

3	By default, all dates are included in the report.

▪	To specify a specific day for the report, select Date, and type a date or select from the calendar.

▪	To specify a range of dates, select Date Range, and type the dates or select from the calendar.

4	By default, all alerts are included in the report. To filter the report, select Filter by Alerts, and select specific alerts to include in the report.

5	Type a name for the report.

6	Choose a format for the report. By default, a PDF file is created.

7	By default the report is generated and sent by email to the listed recipients. By default, the logged in account displays in the Email Addresses list. You can add more addresses to receive the report by email. A default subject line is included. Set the priority of the email.

8	You also can save the report to a specified location on the Save to Folder tab. Add a path to the location where you want to store the report file.

NOTE: If you want to generate the report in a report editor where you can preview the report, select Interactive. You can save, print, export, and email the document from the Preview window.

9

Click OK.

Managing event definitions

Managing event definitions

The Event Definitions page lists the events definitions, and for a selected event, the details for that definition and the alert attached to the definition.

Topics 

•	Importing new event definitions

•	Excluding account events from auditing

To manage event definitions

1	Select Auditing & Alerting | Event Definitions.

2	Use the tool bar to manage event definitions.

 

Table 71. Event definitions tool bar

Option	Description
Refresh	Refresh the list.
Import	Import new event definitions into the audit database. See Importing new event definitions.
Enable	Enable selected event definitions.
Disable	Disable selected event definitions.
Remove Alert	Remove a selected alert from a selected event definition.
Exclude Accounts	Exclude accounts and all of their related events from auditing. See Excluding account events from auditing.

Importing new event definitions

Importing new event definitions

The event definitions file, EventDefinitions.edx, is located in the Active Administrator\Server folder. Occasionally new event definition files are made available. You can import these new event definitions into your auditing database.

IMPORTANT: When event definitions are imported, existing definitions with the same name are overwritten.

To import new event definitions

1	Select Auditing & Alerting | Event Definitions.

2	Click Import.

3	Locate the event definitions file (*.edx), and click Open.

NOTE: New event definitions are added and existing definitions are updated. No event definitions are deleted.

4	Click Import.

Excluding account events from auditing

Excluding account events from auditing

The events for specific accounts can be excluded from auditing. Accounts can be removed from the Excluded Accounts list to reinstate auditing of events for those accounts.

To exclude account events from auditing

1	Select Auditing & Alerting | Event Definitions.

You can select to search for accounts to exclude accounts by name, group, or OU.

To exclude accounts by name, select Exclude Accounts by Name.

a	Select a domain, type the account name to be excluded, and click Search.

b	Navigate through the search results selecting one or more accounts to be excluded and click the arrow button to add them to the list of Excluded Accounts.

- OR -

Click the plus sign button to add objects to be excluded by SID.

Type the Account SID and click Load details.

Click Exclude.

To exclude accounts by group, select Exclude Accounts by Group.

a	Select a domain, type the group name that includes the accounts to be excluded, and click Search.

b	Navigate through the search results selecting one or more accounts to be excluded and click the arrow button to add them to the list of Excluded Accounts.

To exclude accounts by organizational usint select Exclude Accounts by OU.

a	Select a domain, type the OU name that includes the accounts to be excluded, and click Search.

b	Navigate through the search results selecting one or more accounts to be excluded and click the arrow button to add them to the list of Excluded Accounts.

2	Optionally, click Refresh to update the list of Excluded Accounts with changes made by other administrators.

3	Click Exclude.

To remove accounts from the Excluded Accounts list

1	Select Auditing & Alerting | Event Definitions.

2	Click Exclude Accounts.

3	Select one or more accounts in the Excluded Accounts list.

4	Click the recycle bin button to remove the selected accounts from the Excluded Accounts list.

5	Optionally, click Refresh to update the list of Excluded Accounts with changes made by other administrators.

6	Click Exclude.