Chat now with support
Chat mit Support

On Demand Audit Current - User Guide

Introducing On Demand Audit Configuring On Demand Audit Change Auditor Integration Working with On Demand Audit Appendix A: Working with Filters Documentation Roadmap

Customizing the columns displayed in a search

When you create a search, a preview displays to help ensure the search criteria meet your needs. You can customize the columns that display in the generated report and easily rearrange the column display order through drag and drop.

The following columns are included by default:

  • Time Detected
  • User (Actor)
  • Activity
  • Target
  • Origin IP
  • Service
  • Status (All Event searches and Sign-in searches only)
  • Tenant Name

To rearrange, add, and remove the columns displayed in the search

  1. As you create a search, click Edit Columns.
  2. Drag and drop the columns to change the order.
  3. To remove a column, click the X next to the appropriate column.
  4. To add a column, click Add Column.
  5. Save your changes.

For a list of available columns, see Appendix A: Working with search columns and filters

Viewing search results and event details

When selecting an event that has been returned from a search, you can view all the details of the activity that triggered the event. If the search contains string filters, the string is highlighted in the search results and event details to allow you to quickly scan for matches.

A summary of important event details is displayed at the top of the event details that includes:

  • Activity Name
  • Service
  • Time Detected
  • User display name
  • Target
  • Location
  • Status (Successful/Failed)

For Azure Active Directory, Active Directory, and Group Policy events, the summary also displays the following:

  • Property After Value
  • Property Before Value
  • Property Name

To view event details

  1. Select the Searches tab.
  2. Locate the required search in the list of categories.
  3. Highlight the search and click the arrow icon to run it.
  4. Click an event to open a new window that contains all the event details.
  5. Click the Event Link to create a dedicated page for the event details within On Demand Audit. Once created you can view the information, copy the URL to share with others, or bookmark it for future use.

Copying event details

When selecting an event that has been returned from a search, you can copy the event details to clipboard to paste into another application.

To copy event details

  1. Select the Searches tab.
  2. Locate the required search in the list of categories.
  3. Highlight the search and click the arrow icon to run it.
  4. Click an event to open a new window that contains all the event details.
  5. Select Copy to clipboard to copy all event details to a clipboard.

Modifying a search

You can easily modify a search to gather the information your require as long you have the right to do so.

 

NOTE:

  • Only custom searches can be modified.
  • Built in searches cannot be modified. However, you can create a new search based on it and customize the settings to suit your needs. See Creating a search from an existing search.

To modify a search

  1. Under the Searches tab, select the search.
  2. Click the pencil icon to modify the search. The type of search  and the current category is displayed at the top of the search..
  3. Edit the search name, remove, add, edit search criteria as required. Search terms are highlighted in the preview (and search results and event details) to allows you to quickly scan for matches.
  4. Change the category, if required by selecting a new category from the drop down list.
  5. Click Edit Columns to rearrange, add, and remove columns as required. See Customizing the columns displayed in a search.
  6. Click Save to apply the changes.
  7. If required, click Alert, select the required alert plan (or create a new alert plan) to notify the required individuals , click Save. See Working with alerts and alert plans
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen