サポートと今すぐチャット
サポートとのチャット

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

AD Query settings

Previous Next

AD Query settings

From the Agent Configuration page on the Administration Tasks tab you can define how to optimize the Active Directory query auditing process, summarizing similar operations from the same client.

Use the AD Query tab at the top of the Configuration Setup dialog to define the settings for summarizing similar operations from the same client and only record the summary in the Active Directory query event:

Discard query results less than nn records

This setting instructs Change Auditor to only generate an event if an Active Directory query returns more or equal to the number of results specified.

The default value is 0; therefore Change Auditor will generate an event even if the Active Directory query returns no results.

Discard queries taking less than nn milliseconds

This setting instructs Change Auditor to only generate an event if the Active Directory query takes longer than or equal to the specified number of milliseconds.

The default value is 20 milliseconds.

Discard duplicate queries occurring within nn minutes

This setting defines how long Active Directory query events are to be ‘held’ to determine if duplicates have occurred before they are forwarded to the Change Auditor client.

The default is 15 minutes meaning Change Auditor will gather Active Directory query events and hold them in a queue to determine if any duplicate queries have been generated during the specified interval. Change Auditor will then forward the AD Query event to the client specifying how many occurrences of that query were performed during the 15 minute interval.

AD Query auditing enabled

This check box is selected by default which enables AD Query auditing. Clearing this check box disables all AD Query auditing on the agents using the agent configuration selected in the left pane, which is often times desired for busy agents.

To set the AD Query settings:
1
Open the Administration Tasks tab.
2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Click Configurations.
5
On the Configuration Setup dialog, select an agent configuration from the left pane.
6
Open the AD Query tab and set the Active Directory query event settings as defined above.
7
Once you have set these settings, click OK to save your selections, close the dialog and return to the Agent Configuration page.
8
On the Agent Configuration page, select the agents assigned to the selected agent configuration and click Refresh Configuration to ensure the agent are using the latest configuration.
 
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

 

Active Directory Query Searches/Reports

Previous Next

Active Directory Query Searches/Reports

•
Introduction
•
Run AD Query reports
•
Create custom AD Query search

Introduction

Previous Next

Introduction

You can search, report and alert on LDAP-enabled applications and how they use Active Directory.

Run AD Query reports

Previous Next

Run AD Query reports

Running the All AD Query Events report will retrieve all the AD Query events captured for Active Directory® containers being audited.

To run the All AD Query Events report:
1
Launch the Change Auditor client and open the Searches tab.
2
In the explorer view (left pane), expand the Shared | Built-in | All Events folder.
3
Locate and double-click All AD Query Events in the right pane.
4
A new Search Results page appears displaying the AD Query events captured over the last seven days.

In addition to the All AD Query Events report, Change Auditor for Active Directory Queries ships with some additional Active Directory Query reports, which are located in the AD Query folder in the explorer view.

To run a more specific AD Query report:
1
Open the Searches tab.
2
In the explorer view, expand the Shared | Built-in | AD Query folder.
3
Locate and double-click one of the AD Query searches in the right-hand pane.
4
This will display a new Search Results page displaying the AD Query events that meet the search criteria defined in the selected search.
* 
NOTE: By default, the AD Query reports display additional LDAP details (such as, LDAP Occurrences, LDAP Results, etc.) in the Search Results page.
関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択