Change Auditor 7.6 - Release Notes

Select STORAGE | File | NAS Servers. Open the server properties and select Event Publishing. Select to Enabling Common Event Publishing. Add the CEPA Server where the CEE is installed, select All Events, and save the settings.

•

Select File System you want to audit and choose the Advanced tab. Under the Events Notifications, select Enable SMB Events publishing.

NOTE: When auditing EMC Unity using an agent on Windows Server 2019, the lowest supported version is EMC Unity 4.4.1.

EMC PowerScale - Supported up to the following versions

EMC Common Event Enabler (CEE) Framework up to 8.9.9.0

Agent

Locate the Change Auditor agent near the EMC device (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored EMC device and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

Use multiple CPU hosts for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

Rights and permissions

•

Administrative rights on the EMC Control Station to create or modify the cepp.conf file on the EMC file server (CIFS).

•

The computer account where the Change Auditor agent is running must have permissions on the EMC Virus Checking policy.

For more information

See the Change Auditor for EMC User Guide for detailed information about installing, configuring, and using Change Auditor for EMC.

NetApp auditing

Table 28. NetApp auditing requirements

Component

Supported Versions

Change Auditor

Change Auditor for NetApp

NetApp Filer

NetApp Filer ONTAP 9.6 to 9.16

NOTE: NetApp events initiated through the NFS protocol are not supported.

Agent

•

Locate a Change Auditor agent close to the NetApp filer (use fastest connection type available).

•

Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored NetApp filer and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

•

Use a multiple CPU host for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

•

In order for the NetApp filer to properly send events to the Change Auditor agent, reverse DNS zone must be configured for the Change Auditor agent server’s IP address. This can be configured in the Reverse Lookup Zone of the DNS server used by the NetApp filer. To verify you can look up a Change Auditor agent using its IP address, use the nslookup command as illustrated below:

•

If Windows Firewall is enabled on the server hosting the Change Auditor agent responsible for capturing the NetApp events, it must be configured to allow ‘File sharing’.

Rights and permissions

NetApp running in cluster mode

Use the Set Credentials button on the NetApp Auditing template. The account should be an Active Directory user with permissions to configure the NetApp Fpolicy and have access to check the security access control list (ACL) of the NetApp files and folders.

HTTP application access must be assigned for the Active Directory user account‌ specified in the auditing template. For NetApp 9.9 and before, ONTAPI access is also required.

You may assign the vsadmin role to the specified Active Directory user account or you can create a custom rest role using NetApp OnCommand System Manager with the following minimum role attributes and access (REST API path and Access Level):

•

Read-only access to /api/storage/volumes

•

Read-only access to /api/svm/svms

•

Read/Write access to /api/protocols/fpolicy

NOTE: domain\username and password are case-sensitive, so the credentials used with the NetApp auditing template must match.

See the NetApp user guide for more details on enabling Active Directory domain users access to the cluster.

For more information

See the Change Auditor for NetApp User Guide for detailed information about installing, configuring, and using Change Auditor for NetApp.

SharePoint auditing

Table 29. SharePoint auditing requirements

Component

Supported versions

Change Auditor

Change Auditor for SharePoint

IMPORTANT: The Change Auditor for SharePoint module processes all activities happening on all site collections within the audited SharePoint farm. When auditing a large SharePoint farm with much activity, the Change Auditor agent may experience performance-related issues including slowness in loading the plugin, slowness in capturing events, or the potential for missed events. Factors that can impact Change Auditor performance include the number of site collections in the farm and the volume of activity taking place in the SharePoint environment. Quest recommends performing a test in an environment that is similar in size and configuration to determine if your farm is suitable to be audited by Change Auditor.

SharePoint

SharePoint Server 2016

SharePoint Server 2019

Required rights and permissions

When selecting the agent to capture SharePoint events, you must enter the credentials to use to access the selected SharePoint farm. This account must have the following permissions:

•

Local Administrator on the Change Auditor Agent\SharePoint Central Administration server

•

SharePoint Farm Administrator

•

The following mappings on the SQL Server that contains the SharePoint databases:

•

SharePoint_Config

SharePoint_Shell_Access

SPDataAccess

•

WSS_Content

SPDataAccess

•

SharePoint_AdminContent

SPDataAccess

For more information

See the Change Auditor for SharePoint User Guide for detailed information about installing, configuring, and using Change Auditor for SharePoint.

Logon Activity auditing

Table 30. Logon Activity auditing requirements
Component	Supported versions
Change Auditor	Change Auditor for Logon Activity User license for auditing server agents Change Auditor for Logon Activity Workstation license for auditing workstation agents
Change Auditor \| Server agents	Change Auditor for Logon Activity User NOTE: See Change Auditor agent (Server-side component).
Change Auditor \| Workstation agents	Change Auditor for Logon Activity Workstation
For more information	See the Change Auditor for Logon Activity User Guide.

Seleziona il prodotto:

Per una maggiore efficacia, compilare l'Obiettivo della chat:

Soluzioni consigliate per il problema

Change Auditor 7.6 - Release Notes

EMC auditing

NetApp auditing

SharePoint auditing

Logon Activity auditing