InTrust 11.6.1 - Audit Database Structure

Name of the computer from which the log was gathered.

Name of the domain to which the computer belongs.

Computer type, e.g. server or workstation. For Windows computers, this field has a bitmask value. For other computers, the value is 0.

For more information about bitmask values, see the description of the SERVER_INFO_101 network management structure in the MSDN library. The sv101_type member defines the possible values.

The computer’s platform (operating system) ID. The following platform IDs are used:

• 500 (Windows)
• 630 (LINUX)

ID of the event in the InTrust gathering session.

ID of the gathering session.

Computer from which the event was retrieved.

Platform (operating system) ID of the computer from which the event was retrieved.

Major version number of the audited software on the computer where the data was collected. InTrust data sources define the major version values as specified below.

When event caching is not used during gathering:

• Microsoft Windows Events, Microsoft DHCP Server Events—Major version of the operating system. For example, the major version of Windows 8 is 6.Custom Text Log Events, Database Events—Major version of the operating system, unless specified otherwise.
• Microsoft IIS Events—The MajorVersion dword value in the HKLM\SOFTWARE\Microsoft\InetStp registry key.
• Microsoft ISA Server Events—The major version number in the string representation of the ISAS version. This string is retrieved from the ProductVersion(BSTR*) property of the IFPCServer interface.
• Microsoft Proxy Server Events—The major version is 2.
• Microsoft Exchange Events—Major version of Microsoft Exchange Server.

When event caching is used during gathering:

• Microsoft Windows Events —Major version of the operating system.
• Syslog, Account Monitoring Events, Text File Monitoring Events—Major version of the operating system, unless specified otherwise.
• Microsoft IIS Events—The MajorVersion dword value in the HKLM\SOFTWARE\Microsoft\InetStp registry key.

Minor version number of the audited software on the computer where the data was collected. InTrust data sources define the minor version values as specified below.

When event caching is not used during gathering:

• Microsoft Windows Events, Microsoft DHCP Server Events —Minor version of the operating system. For example, the minor version of Windows 8 is 2.Custom Text Log Events, Database Events—Minor version of the operating system, unless specified otherwise.
• Microsoft IIS Events—The MinorVersion dword value in the HKLM\SOFTWARE\Microsoft\InetStp registry key.
• Microsoft ISA Server Events—The minor version number in the string representation of the ISAS version. This string is retrieved from the ProductVersion(BSTR*) property of the IFPCServer interface.
• Microsoft Proxy Server Events—The minor version is 0.
• Microsoft Exchange Events—Minor version of Microsoft Exchange Server.

When event caching is used during gathering:

• Microsoft Windows Events —Minor version of the operating system.
• Syslog, Account Monitoring Events, Text File Monitoring Events —Minor version of the operating system, unless specified otherwise.
• Microsoft IIS Events—The MajorVersion dword value in the HKLM\SOFTWARE\Microsoft\InetStp registry key.

The event's number, used for storing the position of the last gathered event.

Name of the user who produced the event.

Domain of the user who produced the event.

Event type.

Name of the event's source.

ID of the event.

Category of the event.

Event generation time in GMT format.

ID of the event in the InTrust gathering session. This field corresponds to the ID field in the Events table.

ID of the gathering session. This field corresponds to the SessionID field in the Events table.

ID of the event in the InTrust gathering session. This field corresponds to the ID field in the Events table.

ID of the gathering session. This field corresponds to the SessionID field in the Events table.