Change Auditor 7.5 - User Guide

Introduction

Introduction

Increasing compliance regulations and security concerns make automated, reliable and complete tracking of user activity essential in organizations today. Change Auditor for Logon Activity captures, alerts, and reports on all user logon and log off activity, and promotes better security, auditing and compliance across your enterprise.

•

Benefits and features

Benefits and features

Change Auditor for Logon Activity offers system-wide visibility, consolidated auditing reports, user activity analysis, automated collection of logon events and a centralized view. Calculated workstation session events deliver an overview of the session in a single event, including the total session length and the reason for logoffs.

More specifically, it provides the following features:

•	Compliance-ready: Fulfills and simplifies collection of logon activity for major external regulations and internal security policies.

•	Real-time alerts on the move: Sends critical alerts on access attempts (both successful and failed logons) via email and mobile devices to prompt immediate action, enabling you to respond faster to security threats even while you’re off-site.

•	Security awareness: Easily discerns user logon by type (interactive, remote, local or network) to help identify suspicious activity.

•	Related searches: Provides instant, one-click access to all information on the event you’re viewing and all related activity, eliminating guesswork and unknown security concerns.

•	Best practice reporting: Provides system visibility with comprehensive reports for best practices, such as access reports, successful logons, failed logons, authorization comparison reports and reports grouped by users.

•	Event timeline: Enables the viewing, highlighting and filtering of logon activity and related change events over time for better forensic analysis of events and trends.

•	Web-based access with dashboard reporting: Searches from anywhere using a web browser, and creates targeted dashboard reports that provide upper management and auditors with access to the information they need without having to understand architecture or administration.

Change Auditor Logon Activity auditing consists of two licenses that allow you to collect logon and log off activity for both servers and workstations.

•	The Change Auditor for Logon Activity User license enables server agents to capture the following events:

▪	Authentication activity (interactive, remote interactive and network logons) including successful and failed logons performed on monitored servers

▪	Domain Controller authentication activity (Kerberos), including successful and failed requests (available for Domain Controller agents only)

▪	User logon session activity (the actual time spent on a server)

•	The Change Auditor for Logon Activity Workstation license enables workstation agents to capture the following events:

▪	Authentication activity (interactive, remote interactive and network logons), including successful and failed logons performed on monitored workstations

▪	User logon session activity (the actual time spent on a workstation)

System requirements

System requirements

For a successful deployment, ensure that your environment meets the minimum system requirements. For information on system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

NOTE: Starting with Change Auditor 6.5, the dependency on InTrust and the Change Auditor Data Gateway Service to capture logon activity is eliminated.

Client components and features

Client components and features

The following table lists the client components and features that require a valid Change Auditor for Logon Activity license. The product will not prevent you from using these features; however, associated events will not be captured unless the proper license is applied.

NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), use the Action | Hide Unlicensed Components menu command. Note this command is only available when the Administration Tasks tab is the active page.

 

 

Table 1. Change Auditor for Logon Activity client components/features

Client Page	Feature
Event Details Pane	What Details: • Subsystem: Logon Activity • Logon Start (Logon Session events) • Logon End (Logon Session events) • Duration (Logon Session events) • Session Start (Logon Session events) • Session End (Logon Session events) NOTE: See Search Results for more information.
Events	Facilities: • Authentication Activity • Domain Controller Authentication (only available with Change Auditor for Logon Activity User auditing module for server agents) • Logon Session
Layout Tab/Search Results Page/Reports	Columns: • Subsystem: Logon Activity • Logon Type • Logon Start (Logon Session events) • Logon End (Logon Session events) • Logon Failure Reason • Logon Session Start (Logon Session events) • Logon Session End (Logon Session events) • Logon Status Code • Logon Duration (Logon Session events)
Search Properties	What Tab: • Subsystem | Logon Activity NOTE: See User Logon Activity Searches/Reports for information on creating custom logon activity search queries.
Searches Page	Built-in Reports: • All Failed Logons in the last 7 days • All Interactive Logons in the past 24 hours • All Kerberos Logons in the past 24 hours • All Logons in the past 24 hours • All Remote Interactive Logons in the past 24 hours • All User Sessions in the past 24 hours NOTE: See Built-in logon activity searches for a description of these search queries.
Alert Body Configuration dialog - Event Details tab	Variables (email tags): • LOGON_DURATION • LOGON_END • LOGON_SESSIONEND • LOGON_SESSIONSTART • LOGON_START • LOGON_TYPE NOTE: See the Change Auditor User Guide for a description of these email tags and how to configure alert email notifications.