Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

Get-CASentinelEventSubscriptions

Previous Next

Get-CASentinelEventSubscriptions

Use this command to see the details of the current Microsoft Sentinel subscriptions.

Table 22. Available parameters

Parameter

Description

-Connection

A connection obtained by using the Connect-CAClient command. See the Change Auditor PowerShell Command Guide for details.

-SubscriptionId (optional)

The ID of an existing Microsoft Sentinel subscription.

If specified, the command will only return the Microsoft Sentinel subscription with that ID. If not specified, all Microsoft Sentinel subscriptions are returned.

Example: Get a list of all Microsoft Sentinel subscriptions

Get-CASentinelEventSubscriptions -Connection $connection

Command output

The command returns the following information.

Table 23. Available configuration information

Setting

Description

Id

The subscription ID.

WebhookSubscriptionId

The webhook subscription ID.

StartTimeUTC

Starting point in time for events being sent.

Subsystems

Subsystems that contain the event data being sent.

Enabled

Whether the subscription is enabled.

HeartbeatUrl

URL for heartbeat notifications.

LastEventTimeUTC

When the last event was sent.

LastEventResponse

Last event response.

LastHeartbeatTimeUTC

When the last heartbeat was sent.

LastHeartbeatResponse

The last heartbeat response.

For example, statusCode = OK (200), statusCode = Bad Request (400), or statusCode = Internal Server Error (500).

EventsSent

Number of events sent.

BatchesSent

Number of batches sent.

HeartbeatsSent

Number of heartbeats sent.

NotificationInterval

How often how often (in milliseconds) notifications are sent.

HeartbeatInterval

How often (in milliseconds) heartbeat notifications are sent.

BatchSize

Batch size. (The maximum number of events that the active batch size can increase to.)

ActiveBatchSize

The current batch size. (The current number of events to include in a single notification message.) The batch size is automatically adjusted based on network throughput and system performance. Its value never exceeds the specified batch size.

AllowedCoordinators

List of coordinators permitted to send events or heartbeat notifications.

LastCoordinator

The last coordinator to send events or modify the subscription.

IncludeO365AADDetails

Identifies whether or not the additionalDetails field with the raw JSON string is included for Microsoft 365 and Microsoft Entra ID events.

When set to true, the event will include fields prefixed with additionalDetails, containing the values from the raw JSON string for Microsoft 365 and Microsoft Entra ID events. When set to false, the additionalDetails field is not included.

Set-CASentinelEventSubscription

Previous Next

Set-CASentinelEventSubscription

Use this command to modify a Microsoft Sentinel subscription

 

Table 2. Available parameters

Parameter

Description

-Connection

A connection obtained by using the Connect-CAClient command. See the Change Auditor PowerShell Command Guide for details.

-Subscription

The PSCASyslogEventSubscriptionStatus object that corresponds to the subscription to modify. This parameter is required if the SubscriptionId parameter is not specified.

-SubscriptionId

The ID of the subscription to modify. This parameter is required if the Subscription parameter is not specified. Use the Get-CASentinelEventSubscriptions command to find the ID.

-Subsystems (Optional)

Specifies an array of event subsystems from which to send events. This can be single or multiple subsystems.

NOTE:  
•
To obtain an array of subsystems, use the Get-CAEventExportSubsystems command and filter the list to specify the required subsystems.

-WorkspaceID (Optional)

The unique identifier for the Log Analytics workspace that has been enabled for Microsoft Sentinel.

-SecretKey (Optional)

The primary or secondary key for the Log Analytics workspace that has been enabled for Microsoft Sentinel.

-BatchSize (Optional)

Specifies the maximum number of events to include in a single notification. The maximum is 6500 events.

-Enabled (Optional)

Specifies whether the subscription is enabled or disabled.

-NotificationInterval (Optional)

Specifies how often (in milliseconds) notifications are sent to Microsoft Sentinel. Setting to 0 results in a continuous stream of events.

-HeartbeatInterval (Optional)

Specifies how often (in milliseconds) heartbeat notifications are sent to the Heartbeat URL. Heartbeat notifications are sent to the Heartbeat_ChangeAuditor_CL log in Microsoft Sentinel where you can query and alert on them if required. Setting this to 0 disables the heartbeat message if enabled.

-AllowedCoordinators (Optional)

Specifies the DNS or NetBIOS name of the coordinators permitted to send events. If you specify a null or empty array, any coordinator can send the results.

NOTE: The list order does not determine which coordinator is selected to send events.

-IncludeO365AADDetails (Optional)

Specifies whether to include the raw JSON event details provided by Microsoft. When set to true, the event will include fields prefixed with additionalDetails, containing the values from the raw JSON string for Microsoft 365 and Microsoft Entra ID events. When set to false, the additionalDetails field is not included.

Example: Set a new batch size value for a Microsoft Sentinel subscription

Set-CASentinelEventSubscription -Connection $connection -SubscriptionId $subscriptionId -BatchSize $newIntValue

Remove-CASentinelEventSubscription

Previous Next

Remove-CASentinelEventSubscription

Use this command to remove a subscription.

Table 24. Available parameters

Parameter

Description

-Connection

A connection obtained by using the Connect-CAClient command. See the Change Auditor Command Guide for details.

-Subscription

The PSCASentinelEventSubscriptionStatus object obtained using Get-CASentinelEventSubscriptions that corresponds to the subscription to remove. This parameter is required if the SubscriptionId parameter is not specified.

-SubscriptionId

The ID of the subscription to remove. This parameter is required if the Subscription parameter is not specified. Use the Get-CASentinelEventSubscriptions command to find the ID.

Example: Remove a subscription

Remove-CASentinelEventSubscription -Subscription $subscription

Microsoft Sentinel event subscription wizard

Previous Next

Microsoft Sentinel event subscription wizard

From the Event Subscription Wizard you can add and edit a Microsoft Sentinel subscription.

* 
NOTE:  
•
Optional subscription settings can be set through PowerShell, see Set-CASentinelEventSubscription.
•
The Workspace ID and the secret keys (Primary and Secondary) can be found in Settings on the Agents management page for the Log Analytics workspace configured for Microsoft Sentinel (Microsoft Entra admin center).
To create a subscription
1
Click Add | Microsoft Sentinel subscription to open the wizard.
2
Specify the Workspace ID for the Log Analytics workspace that has been enabled for Microsoft Sentinel.
3
Specify the secret key for the Log Analytics workspace that has been enabled for Microsoft Sentinel.
4
Click Next to select the events to forward based on subsystem and event date.
▪
By default, events start sending after the subscription is created. To change when to begin collecting and sending events, click Send events starting from and select the desired date and time.
▪
Select the subsystems to include in the subscription.
5
Click Finish.
To edit the subscription
1
Select the required subscription and click Edit.
2
If required, enter the new Workspace ID or secret key and click Next.
3
If required, add and remove the subsystems included in the subscription.
4
Click Finish.

 

 

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione