Change Auditor 7.5 - User Guide

Custom Searches and Search Properties

Custom Searches and Search Properties

•	Introduction

•	Create a custom search

•	Search Properties tabs

Introduction

Introduction

You can create custom search definitions to search for the configuration changes that need to be tracked in your environment. The search properties tabs across the bottom of the Searches page allows you to define new custom searches.

 

Two new columns have been added as of Change Auditor 7.0 that allow you to display extra information through the search Layout tab:

Table 1. Available columns

Layout Tab	Search Column Name	Description
Origin - AD Site Name	Origin AD Site	The Active Directory site of the computer from which the event originated.
User- Is Administrator	Administrator	‘Yes’ indicates that the user is a direct or indirect member of the local Administrators, Active Directory Administrators, Domain Admins or Enterprise Admins groups. NOTE: You can now filter searches to include or exclude users with the Administrator right.

Create a custom search

Create a custom search

The following procedure provides the ‘general’ steps involved in creating a custom search.

NOTE: Selecting the Private folder creates a search that only you can run and view. Selecting the Shared folder creates a search that all users can run and view.

To define a new search:

1	Open the Searches page.

2	In the explorer view (left pane), expand and select the folder where you want to save your search.

3	Click New at the top of the Searches page.

4	On the Search Properties tabs, enter the search criteria to use:

▪	Info — enter a name and description for the search

▪	Who — allows you to search for events generated by a specific user, computer, group, or service account.

▪	What — allows you to search for events based on subsystem, event class, object class, severity, or result

▪	Where — allows you to search for events captured by a specific agent, domain or site

▪	When — allows you to search for events that occurred during a specified date and time range

▪	Origin — allows you to search for events that originated from a specific workstation or server

 

NOTE: When you specify criteria on more than one search properties tab (for example, Who, What and Where tabs), Change Auditor first evaluates each individual tab’s criteria and then chains the individual tab’s criteria together using the ‘AND’ operator, returning only those events that meet all the specified search properties.

5	To be notified when an event is captured as a result of this custom search, open the Alert tab to enable and define how and where to dispatch alerts when the selected search criteria is met. See Enable Alert Notifications for more information about setting up alert notifications.

6	Once you have defined the search criteria to use, you can either save the search definition or run the search.

▪	To save and run the search, click Run from one of the Search Properties tabs.

▪	To save the search definition without running it, click Save from one of the Search Properties tabs.

▪	To create a search using a different name than was initially entered, click Save As | Save As from one of the Search Properties tabs.

▪	To save the search definition as the new default for new searches, click Save As | Save As Default from one of the Search Properties tabs.

Search Properties tabs

Search Properties tabs

To define custom search criteria, use the Search Properties tabs, which are displayed across the bottom of the Searches page. The Search Properties tab pane consists of the following tabs:

•

Info tab

•

Who tab

•

What tab

•

Where tab

•

When tab

•	Origin tab

•	Alert tab (Search Properties tabs)

•	Report tab (Search Properties tabs)

•	Layout tab

•

SQL tab

•

XML tab

To display and enable the Search Properties tabs:

1	From the Searches page:

▪	Click Show Properties

▪	Right-click a folder (left pane) or search definition (right pane) and select Show Properties

▪	Select a folder (left pane) or search definition (right pane) and click New | New Search

NOTE: You can also display the Search Properties tabs from a Search Results tab, using Search Properties.

2	Use the “X” hide button in the upper right corner of the Search Properties tab pane to hide this pane.