Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.3 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level SQL Extended Events Threat Detection

Exchange

All Exchange Administrative Group events in last 30 days
Who = All Users
What = Exchange Administrative Group facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
All Exchange Distribution List events in last 30 days
Who = All Users
What = Exchange Distribution List facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
All Exchange Organization events in last 30 days
Who = All Users
What = Exchange Organization facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
All Exchange Permission Tracking events in last 30 days
Who = All Users
What = Exchange Permission Tracking facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
All Exchange User events in last 30 days
Who = All Users
What = Exchange User facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers

Group Activity

Critical Group Membership changes in last 30 days
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group; Nested Member Added to Critical Enterprise Group; Nested Member Removed from Critical Enterprise Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group Membership changes in last 30 days
Who = All Users
What = Member Added to Group; Member Removed from Group; Nested Member Added to Group; Nested Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers

Group Management

AdminCount changed on group objects in the last 30 days
Who = All Users
What = AdminCount attribute changed on group object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group added in last 30 days
Who = All Users
What = Group Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group deleted in last 30 days
Who = All Users
What = Group Object Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group high severity sIDHistory changed in the last 30 days
Who = All Users
What = Well-known SID added to group object sIDHistory, Same domain SID added to group object sIDHistory
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group member added changes in last 30 days
Who = All Users
What = Member Added to Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group member removed changes in last 30 days
Who = All Users
What = Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group moved in last 30 days
Who = All Users
What = Group Object Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group nested member added changes in last 30 days
Who = All Users
What = Nested Member Added to Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group nested member removed changes in last 30 days
Who = All Users
What = Nested Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group permissions changed in last 30 days
Who = All Users
What = DACL Changed on Group Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group renamed (SAM account name) changes in last 30 days
Who = All Users
What = Group samAccountName Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group renamed in last 30 days
Who = All Users
What = Group Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group sIDHistory changed in the last 30 days
Who = All Users
What = Different domain SID added to group object sIDHistory, Different domain SID removed from group object sIDHistory, Well-known SID added to group object sIDHistory, Well-known SID removed from group object sIDHistory, Same domain SID added to group object sIDHistory, and Same domain SID removed from group object sIDHistory
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Group type changes in last 30 days
Who = All Users
What = Group Type Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers

Organizational Unit Management

Organizational Units added in last 30 days
Who = All Users
What = Subordinate OU Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Organizational Units deleted in last 30 days
Who = All Users
What = Subordinate OU Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Organizational Units renamed in last 30 days
Who = All Users
What = Subordinate OU Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Organizational Units set to block GPO inheritance in last 30 days
Who = All Users
What = Group Policy Block Inheritance Setting Changed on OU
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione