Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

NetApp event logging

Previous Next

NetApp event logging

* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

In addition to real-time event auditing, you can enable event logging to capture NetApp events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

Event logging is disabled by default. When enabled, only configured activities are sent to the ChangeAuditor for NetApp event log. See the Change Auditor for NetApp Event Reference Guide for a list of the events that can be sent to the event log.

To enable event logging:
1
Open the Administration Tasks tab.
2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Click Event Logging.
5
On the Event Logging dialog, select NetApp.
6
Click OK to save your selection and close the dialog.
 

The NetApp events configured in the NetApp Auditing template will then be sent to the ChangeAuditor for NetApp event log.

NetApp Searches/Reports

Previous Next

NetApp Searches/Reports

•
Introduction
•
Create custom NetApp searches

Introduction

Previous Next

Introduction

You can create custom search definitions to search for file and/or folder changes to a specific NetApp file, folder or volume. You will use the Search Properties tabs across the bottom of the Searches page to define new custom searches.

 

Create custom NetApp searches

Previous Next

Create custom NetApp searches

The following scenarios explain how to use the What tab to create custom NetApp searches.

To search for all file system events including NetApp events:
* 
NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:
•
Who - allows you to search for events generated by a specific user, computer or group
•
Where - allows you to search for events captured by a specific agent or within a specific domain or site
•
When - allows you to search for events that occurred within a specific date/time range
•
Origin - allows you to search for events that originated from a specific workstation or server
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all users.

3
Click New at the top of the Searches page.

This will activate the Search Properties tabs across the bottom of the Searches page.

4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | File System.
6
On the Add File System Path dialog, select the All File System Paths option.
7
Review the Actions section and select those that are to be included in the search.

By default, All Actions is selected meaning that all of the actions associated with the file system path will be included in the search.

8
Click OK to save your selection and close the dialog.
9
Once you have defined your search criteria, click Run to save and run the search.
10
When this search runs, Change Auditor searches for all file system events including NetApp events and display the results in a new search results page.
To search for events performed against a specific NetApp file or folder:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | File System.
6
On the Add File System Path dialog, select one of the following scope options:
▪
This Object - select to search only the selected object.
▪
This Object and Child Objects Only - select to search the selected object and its direct child objects.
▪
This Object and All Child Objects - select to include the selected object and all subordinate objects (in all levels)
7
In the Path field, enter or use the browse button to select the NetApp filer path to be searched.
▪
To search for events against a specific volume, enter the path as follows: \\<FilerName>\<ShareName>\
▪
To search for events against a specific folder, enter the path as follows: \\<FilerName>\<ShareName>\<FolderName>\
▪
To search for events against a specific file, enter the path as follows: \\<FilerName>\<ShareName>\<FolderName>\<FileName.ext>
* 
NOTE: If the scope of your search is This Object, you can use the * wildcard character to specify the NetApp filer path. That is, use an asterisk (*) to substitute zero or more characters.

When using the This Object option, be sure to select the appropriate Type option to define the type of path to be searched: Files or Folders.

8
Review the Actions section and select those that are to be included in the search.

By default, All Actions is selected meaning that all of the actions associated with the path will be included in the search.

When the scope includes child objects, All Types are selected by default meaning that all types of paths will be searched. If you selected the This Object scope option, Files is selected by default, which can be changed to Folders. Only one type can be selected.

* 
NOTE: The Transaction option does not apply to NetApp events.
9
Click OK to save your selection and close the dialog.
10
Click Run to save and run the search. Click Save to save the search definition without running it.
11
When this search runs, Change Auditor searches for NetApp events in the selected path and display the results in a new search results page.
To search for a specific NetApp event class:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, click Add (or expand Add and select Event Class).
6
On the Add Facilities or Event Classes dialog, enter NetApp in the data filter field under the Facility heading to display all of the NetApp events.
7
From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.
8
Click Run to save and run the search. Click Save to save the search definition without running it.
9
When this search runs, Change Auditor searches for the NetApp events based on the search criteria specified on the What tab and display the results in a new search results page.

 

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione