Tchater maintenant avec le support
Tchattez avec un ingénieur du support

Change Auditor 7.2 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level Threat Detection

User Management

AdminCount changed on user objects in the last 30 days
Who = All Users
What = AdminCount attribute changed on user object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Changes to user profiles in last 30 days
Who = All Users
What = Home Folder Changed on User Object; Home Folder Mapped Drive Changed on User Object; Level of Control Changed for User Object; Primary Group ID Changed for User Object; Profile Path Changed on User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Permissions on user accounts changed in last 30 days
Who = All Users
What = DACL Changed on User Object; Required User’s Permissions Changed for User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users added in last 30 days
Who = All Users
What = User Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users added to group in last 30 days
Who = All Users
What = User Member-of Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users deleted in last 30 days
Who = All Users
What = User Object Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users disabled in last 30 days
Who = All Users
What = User Account Disabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users display name changed in last 30 days
Who = All Users
What = Display Name Changed on User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users enabled in last 30 days
Who = All Users
What = User Account Enabled; User Account Re-enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users first name changed in last 30 days
Who = All Users
What = First Name Changed on User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users high severity sIDHistory changed in the last 30 days
Who = All Users
What = Well-known SID added to user object sIDHistory, Same domain SID added to user object sIDHistory
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users last name changed in last 30 days
Who = All Users
What = Last Name Changed on User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users locked out in last 30 days
Who = All Users
What = User Account Locked
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users logon hours changed in last 30 days
Who = All Users
What = User logonHours Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users moved in last 30 days
Who = All Users
What = User Object Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users name(s) changed in last 30 days
Who = All Users
What = Display Name Changed on User Object; First Name Changed on User Object; User samAccountName Changed; Last Name Changed on User Object; User userPrincipal Name Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users principal name changed in last 30 days
Who = All Users
What = User userPrincipalName Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users servicePrincipalName changed in the last 30 days
Who = All Users
What = ServicePrincipalName added to user object, ServicePrincipalName removed from user object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users sIDHistory changed in the last 30 days
Who = All User
What = Different domain SID added to user object sIDHistory, Different domain SID removed from user object sIDHistory, Well-known SID added to user object sIDHistory, Well-known SID removed from user object sIDHistory, Same domain SID added to user object sIDHistory, and Same domain SID removed from user object sIDHistory
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users removed from group in last 30 days
Who = All Users
What = User Member-of Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users renamed in last 30 days
Who = All Users
What = Domain User Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users SAM account name changed in last 30 days
Who = All Users
What = User samAccountName Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users status changed in last 30 days (Enabled, Disabled, Created, Deleted, Locked, Unlocked)
Who = All Users
What = User Account Enabled; User Account Disabled; User Object Added; User Object Removed; User Account Locked; User Account Unlocked; User Account Re-enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users unlocked in last 30 days
Who = All Users
What = User Account Unlocked
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users workstation access restrictions changed in last 30 days
Who = All Users
What = User userWorkstations Added; User userWorkstations Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers

SharePoint

* 
NOTE: By default, the SharePoint reports include the following information on the Search Results page: SharePoint Item Name, SharePoint List Name and SharePoint Web Name. These additional columns are defined using the Layout tab.
All SharePoint events in the last 7 days
Who = All Users
What = SharePoint subsystem
Where = All sources
When = Last 7 day
Origin = All workstations/servers
Document Content changes in the last 7 days
Who = All Users
What = Document added; Document check out canceled; Document checked in; Document checked out; Document deleted; Document metadata updated; Document updated
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Document Story changes in the last 7 days
Who = All Users
What = All document versions deleted; Document added; Document check out canceled; Document checked in; Document checked out; Document deleted; Document library added; Document library deleted (empty); Document library deleted (with contents); Document library renamed; Document library restored from recycle bin; Document metadata updated; Document moved; Document renamed; Document restored from recycle bin; Document updated; Document version deleted; Document viewed; SharePoint folder deleted; SharePoint folder moved; SharePoint folder renamed; SharePoint folder restored from recycle bin; SharePoint folder updated; Site collection deleted; Site deleted; Site moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Document Version changes in the last 7 days
Who = All Users
What = All document versions deleted; Document version deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
List item changes in the last 7 days
Who = All Users
What = All list item versions deleted; List item added; List item attachment added; List item attachment deleted; List item deleted; List item restored from recycle bin; List item updated; List item version deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Permission changes in the last 7 days
Who = All Users
What = All permission levels revoked; Permission level created; Permission level deleted; Permission level granted; Permission level permissions modified; Permission level revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Permission Inheritance changes in the last 7 days
Who = All Users
What = Permission inheritance broken; Permission inheritance restored; Permission level inheritance broken; Permission level permissions modified
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection Groups created and deleted in the last 7 days
Who = All Users
What = Security group created; Security group deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection Groups membership changes in the last 7 days
Who = All Users
What = Member added to security group; Member removed from security group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collection Ownership changes in the last 7 days
Who = All Users
What = Site collection ownership granted; Site collection ownership revoked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Site Collections created and deleted in the last 7 days
Who = All Users
What = Site collection created; Site collection deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Sites created and deleted in the last 7 days
Who = All Users
What = Site created; Site deleted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Sites moved in the last 7 days
Who = All Users
What = Site moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers

SQL Data Level

SQL Data Level Events in the last 24 hours
Who = All Users
What = Check Constraint Added to a Table; Check Constraint Removed from a Table; Default Constraint Added to a Table; Default Constraint Removed from a Table; Default Object Added; Default Object Removed; Foreign Key Added to a Table; Foreign Key Removed from a Table; Function Added; Function Altered; Function Removed; Index Added to a Table; Index Removed from a Table; Object Renamed; Primary Key Added to a Table; Primary Key Removed from a Table; Procedure Added; Procedure Altered; Procedure Removed; Row Added to a Table; Row Removed from a Table; Row Updated in a Table; Rule Added; Rule Removed; Statistics Added to a Table; Statistics Removed from a Table; Table Added; Table Altered; Table Removed; Table Truncated; Trigger Added; Trigger Altered; Trigger Removed; Type Added; Type Removed; User Added; User Removed; View Added; View Altered; View Removed
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
SQL Data Level Row Change Events in the last 24 hours
Who = All Users
What = Row Added to a Table; Row Removed from a Table; Row Updated in a Table
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
SQL Data Level Structure Change Events in the last 7 days
Who = All Users
What = Check Constraint Added to a Table; Check Constraint Removed from a Table; Default Constraint Added to a Table; Default Constraint Removed from a Table; Default Object Added; Default Object Removed; Foreign Key Added to a Table; Foreign Key Removed from a Table; Function Added; Function Altered; Function Removed; Index Added to a Table; Index Removed from a Table; Object Renamed; Primary Key Added to a Table; Primary Key Removed from a Table; Procedure Added; Procedure Altered; Procedure Removed; Rule Added; Rule Removed; Statistics Added to a Table; Statistics Removed from a Table; Table Added; Table Altered; Table Removed; Table Truncated; Trigger Added; Trigger Altered; Trigger Removed; Type Added; Type Removed; User Added; User Removed; View Added; View Altered; View Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Threat Detection

All Threat Detection critical alert events in the last 24 hours

What = Threat Detection subsystem
Where = N/A
When = Last 24 hours
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)

All Threat Detection critical risky user events in the last 24 hours

What = Threat Detection subsystem
Where = N/A
When = Last 24 hours
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)
All Threat Detection events in the last 7 days
What = Threat Detection subsystem
Where = N/A
When = Last 7 days
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)
All Threat Detection risky user events in the last 7 days
What = Threat Detection - User facility
Where = N/A
When = Last 7 days
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)
All Threat Detection alert events in the last 7 days
What = Threat Detection - Alert facility
Where = N/A
When = Last 7 days
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)
All Threat Detection risky user and alert events in the last 24 hours
What = Risky user identified, Threat detection alert added events
Where = N/A
When = Last 24 hours
Origin = Threat Detection server
Layout tab - Order By: Time Detected (Not Grouped)
Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation