InTrust 11.6.1 - Preparing for Auditing Microsoft Exchange Server

Processing Exchange-Related Logs

Using InTrust, you can collect and report on audit data related to Microsoft Exchange Server.

The following Exchange Server versions are supported:

• 2019
• 2016
• 2013 Service Pack 1
• 2013

Table 1: List of Third-Party Contributions

Collecting CA for Exchange Log Data

The CA for Exchange log is made available by Change Auditor for Exchange agents on Exchange servers. InTrust provides a preconfigured workflow for collecting this type of log and reporting on the data.

To work with CA for Exchange log data

1. In InTrust Manager, locate the predefined Exchange-related tasks:

   • Auditing Exchange Servers: Daily Gathering

   • Auditing Exchange Servers: Ad-Hoc Reporting for the Last 24 Hours

   • Auditing Exchange Servers: Daily Reporting

   • Auditing Exchange Servers: Weekly Reporting

2. Make copies of the tasks that best fit your needs. In your new tasks, adjust the settings of the jobs as necessary. For example, you may want to change the set of reports or report delivery method.
3. Configure and enable the schedules of the tasks.
4. Commit your changes.

Collecting Exchange Tracking Log Data

InTrust does not provide a ready-made set of configuration objects for gathering and reporting on Exchange Tracking log data. However, the core components for creating this workflow are available, and only a few configuration steps are required.

To work with Tracking log data

1. In InTrust Manager, create a data source that will represent the Tracking log:
   1. Right-click Quest InTrust Manager | Configuration | Data Sources and select New Data Source.
   2. On the Select Data Source Type step of the New Data Source Wizard, select Microsoft Exchange Events.
   3. Specify the name and optionally a description of the data source and complete the wizard.
2. Adjust the predefined site that contains Exchange servers:
   1. Open the properties of the Quest InTrust Manager | Configuration | Sites | Microsoft Windows Network | Auditing Exchange Servers: Exchange Servers site.
   2. On the Objectstab, specify your Exchange servers.
3. Create a gathering policy that will configure how the Tracking log is handled:
   1. Right-click Quest InTrust Manager | Configuration | Gathering | Gathering Policies | Microsoft Windows Network and select New Policy.
   2. On the Data Sources step of the Add Data Source Wizard specify the data source you have created.
   3. Follow the remaining steps and configure the data source options as necessary.
4. Set up a task that will specify what to do with Tracking log data:
   1. Create the task. For that, right-click Quest InTrust Manager | Workflow| Tasks and select New Task and complete the steps.
   2. Right-click the newly-created task and select New Job.
   3. On the Job Type step of the New Job Wizard, select Gathering.
   4. On the Select Policy step, select the gathering policy you have created.
   5. On the Select Site step, select Auditing Exchange Servers: Exchange Servers.
   6. On the Data Stores step, make sure you gather to a repository.
   7. Complete the steps.
5. Enable the schedule for your task if you haven't already done so.
6. Commit your changes.

The procedure above implements a minimal workflow required to get the Tracking log data into a data store. You can make further improvements to it as necessary: tweak gathering and filtering settings, enable notifications, configure data consolidation and cleanup, and so on.

To analyze the resulting Tracking log data, use Repository Viewer.

Further Reading

If you need more information about InTrust workflows and configuration, refer to the following topics:

• For details about tasks and jobs, see the Auditing Guide.
• For details about SSRS-based reporting, see Leveraging Microsoft SQL Server Reporting Services Integration for Advanced Reporting.
• For details about analyzing gathered events in InTrust repositories, see Searching for Events in Repository Viewer, Reporting on Events Using Repository Viewer and the IT Security Search User Guide (available at https://support.quest.com/it-security-search/technical-documents).