Change Auditor 7.5 - User Guide

Introduction

Introduction

You can use predefined reports to retrieve valuable change information from a variety of perspectives.

NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

You can also create custom search definitions to search for the configuration changes that need to be tracked in your environment. You will use the search properties tabs across the bottom of the Searches page to define new custom searches.

 

Authentication Services built-in reports

Authentication Services built-in reports

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To run a built-in search:

1	Click on the Searches tab or select View | Searches.

2

Expand and select the appropriate folder in the explorer view (left-hand pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Authentication Services will display all the built-in searches available for One Identity Authentication Services.

3	In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:

▪	Double-click a search definition

▪	Right-click a search definition and select the Run menu command

▪	Select the search definition and click the Run tool bar button at the top of the Searches page

4	A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.

NOTE: To modify a built-in search or create a custom Authentication Services search, see the Change Auditor User Guide.

Create custom searches

Create custom searches

The following scenario explain how to use the What tab to create custom searches.

 

NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria: • Who - allows you to search for events generated by a specific user, computer or group • Where - allows you to search for events captured by a specific agent or within a specific domain or site • When - allows you to search for events that occurred within a specific date/time range • Origin - allows you to search for events that originated from a specific workstation or server

To search for a specific event class:

1	Open the Searches page.

2	In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

3	Click New at the top of the Searches page.

This will activate the Search Properties tabs across the bottom of the Searches page.

4	On the Info tab, enter a name and description for the search.

5	Open the What tab, click Add (or expand the Add tool bar button and select Event Class).

6	On the Add Facilities or Event Classes dialog, enter Authentication Services Monitoring in the data filter field under the Facility heading to display all of the Authentication Services events.

7	From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.

8	Click Run to save and run the search. Click Save to save the search definition without running it.

9	When this search runs, Change Auditor searches for the Authentication Services events based on the search criteria specified on the What tab and display the results in a new search results page.

Search results

Search results

The event information (including key information like who, what, when, where, why, the event origin, and the file information) can be viewed on the Event Details pane.

Table 1. Event Details pane: Authentication Services events

ChangeAuditor	Description
Severity	Displays “Low”, “Medium”, or “High” depending on the event.
Who	Specifies the name of the user who initiated the change.
When	Specifies the date and time when the change occurred.
Where	Displays the name of the workstation where the change occurred.
Source	Displays ‘Change Auditor’ which is the application from which the event was retrieved.
Origin	Displays the NetBIOS name and IP address of the workstation from which the event was generated.
What	Displays a description of the activity that occurred. NOTE: For lengthy descriptions, hover your cursor over the description field to view the entire event description.
Facility	Displays that it is Authentication Services Monitoring activity.