Change Auditor 7.3 - Event Reference Guide

System Events

Threat Detection Events

The Threat Detection event details pane includes a link that opens the Threat Detection dashboard where you can gain more information on the potential threat.

For risky user events, the View risky user details link opens the dashboard on the Users page; for Threat Detection alert events, the View alert details link opens the dashboard on the Alerts page.

Events are written as they are detected on the Threat Detection server. The coordinator checks the Threat Detection server for new events every 20 mins.

NOTE: For events generated prior to version 7.0.4, critical and high severity in Threat Detection map to High severity in Change Auditor.

For details about using the Threat Detection dashboard see the Change Auditor Threat Detection User Guide.

The Threat Detection events includes the following additional information:

Log Events

When event logging for Change Auditor is enabled, internal Change Auditor events will be written to a Windows event log, named Change Auditor Coordinator Service event log. In addition, when event logging for Registry, Service and/or Local Account is enabled in Change Auditor, related events will be written to the Change Auditor Service event log. These log events can then be gathered by InTrust for further processing and reporting.

NOTE: To enable event logging, select Event Logging on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to enable.

The tables in this chapter list the log events captured by the different event logs when the corresponding event logging is enabled. They are listed in numeric order by event ID based on the event log to which they are recorded:

Change Auditor Coordinator Service event log

The following internal Change Auditor events are recorded to the Change Auditor Coordinator Service event log when Change Auditor event logging is enabled.