지금 지원 담당자와 채팅
지원 담당자와 채팅

Change Auditor 7.5 - User Guide

Welcome to Change Auditor Help Change Auditor Core Functionality
Change Auditor Core Functionality Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Working with Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags
Microsoft 365 and Microsoft Entra ID Auditing Change Auditor for Active Directory
Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane About us
Change Auditor for Authentication Services Change Auditor for Defender Change Auditor for EMC Change Auditor for Exchange Change Auditor for Windows File Servers Change Auditor for Active Directory Queries Change Auditor for Logon Activity Change Auditor for NetApp Change Auditor for SharePoint Change Auditor for SQL Server Change Auditor SIEM Integration Guide
Webhooks in Change Auditor Integrating Change Auditor and SIEM Tools Subscription Management
Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions Working with event subscriptions in the client Managing a Splunk integration Splunk event subscription wizard Managing an IBM QRadar integration QRadar event subscription wizard Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration ArcSight event subscription wizard Managing a Quest IT Security Search integration (Preview) Managing a Syslog integration Syslog event subscription wizard Managing a Microsoft Sentinel integration Microsoft Sentinel event subscription wizard
Webhook technical insights
Change Auditor Threat Detection Deployment Change Auditor Threat Detection Dashboard Change Auditor PowerShell Command Guide Change Auditor Dialogs
Change Auditor dialogs
Quest Change Auditor dialog Add Administrator Add Agents, Domains, Sites dialog Add Container dialog Add Active Directory Container dialog (AD Query) Add Facilities or Event Classes dialog Add Facilities or Event Classes dialog (Add With Events) Add File System Path dialog Add Foreign Forest Credential Add Group Policy Container dialog Add Local Account dialog Add Logons dialog Add Logons dialog (Add With Events) Add Object Classes dialog Add Object Classes dialog (Add With Events) Add Origin dialog Add Origin dialog (Add With Events) Add Registry Key dialog Add Results dialog Add Service dialog Add Service dialog (Add With Events) Add Severities dialog Add Severities dialog (Add With Events) Add SharePoint Path dialog Add SQL Instance dialog Add SQL Data Level Object Add Users, Computers or Groups dialog Add Where dialog Add Who dialog Advanced Deployment Options dialog Agent Assignment dialog Alert Body Configuration dialog Alert Custom Email dialog Auditing and Protection Templates dialog Authorizations: Application Group dialog Authorizations: Operations | Role Definitions | Task Definitions | Application Group Authorizations: Role dialog Authorizations: Task dialog Auto Deploy to New Servers in Forest dialog Browse for Folder dialog Browse SharePoint dialog Comments dialog Configuration Setup dialog Configure cepp.conf Auditing dialog Connection screen Coordinator Configuration tool Coordinator Credentials Required dialog Credentials Required dialog Custom Filter dialog Database Credentials Required dialog Directory object picker Domain Credentials dialog Eligible Change Auditor Agents dialog Event Logging dialog Export/Import dialog Install or Upgrade/Uninstall/Update Foreign Agent Credentials IP Address dialog Log page Logon Credentials dialog (Deployment page) Logon Credentials dialog (EMC Auditing wizard) Manage Connection Profiles dialog New Report Layout dialog Microsoft 365 dialog Rename dialog Save As dialog Select a SQL Instance and Database dialog Select Destination Folder dialog Select Exchange Users dialog Select Registry Key dialog Select SQL Reporting Services Template dialog Shared Mailboxes dialog SharePoint Credentials Required dialog When dialog
About Us

Overview

Previous Next

Overview

Once agents are deployed, the Overview page initially displays when the client successfully connects to a coordinator. This page highlights application details based on your preference. For example, you can display Agent Status, Top Agent Activity, Recent Event Activity, Coordinator Status, Event Counts, or Alert History Counts.

You can view a real-time stream of events based on a ‘favorite’ search definition. By default, the top pane uses the Change Auditor Real-Time search definition and display all events (up to 10,000 records) generated in the last 20 minutes. You can, however, define a different ‘favorite’ search and the events captured from that search will then be displayed across the top of the Overview page.

The information on this page is captured when the client starts. To refresh all of the information displayed on the Overview page, select Refresh. Also, when you select a different pane for display, the latest information for the 'new' pane will be displayed.

My Favorite Search

Previous Next

My Favorite Search

The Overview top pane displays a real-time view of events generated based on a user-defined ‘favorite’ search. By default, the Change Auditor Real-Time search definition is used and all events captured for the last 20 minutes are displayed

As events are returned, they are added to the search results, providing you with a real-time view of what’s happening in your environment. By default, the events are sorted by date, with the latest event being added to the top of the list. You can, however, use the column controls to select a different sort criteria for the information displayed. For more information on customizing the content of this table, see Customize table content.

Double-clicking an event displays the Event Details pane across the bottom of the page, which contains additional details regarding the selected event. The layout and content for My Favorite Search is the same as that used on the Search Results page. For a description of the search results grid and the Event Details pane, please refer to Search Results grid and Event Details pane.

Define a favorite search

Previous Next

Define a favorite search

By default the Change Auditor Real-Time search (all events captured in the last 20 minutes) is used to capture the events displayed on the Overview page. You can, however, select a different ‘favorite’ search, which will then be used to populate the top pane on the Overview page.

To define a ‘favorite’ search:
1
Open the Searches page.
2
Select the search to use, right-click and select Set As My Favorite.
3
Open the Overview page, click Refresh to display the results of that search in the My Favorite Search pane at the top of the Overview page.
To modify the current ‘favorite’ search:
1
From the Overview page, click My Favorite Search: <search name> title at the top of the My Favorite Search grid.
2
The Searches page and corresponding search properties tab are displayed.
3
Use the search properties tabs to modify the search criteria. Click Save from one of the search properties tabs to save your changes.
4
Open the Overview pane, click Refresh to display the results of the modified search in the My Favorite Search pane.

Overview panes

Previous Next

Overview panes

You can customize the Overview panes across the bottom of the Overview page based on your preference to display a variety of overview information about Change Auditor. By default, the Top Agent Activity and Agent Status panes display across the bottom of the Overview page. However, each of these panes has an arrow button on its heading that you can use to display different overview information.

The following overview views are available:

•
Top Agent Activity
•
Recent Event Activity
•
Count of Events By
•
Agent Status
•
Coordinator Status
•
Alert History Counts

Within the overview panes, blue underlined numbers are hypertext links. Selecting a link displays the search results for the selected count.

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택