InTrust 11.6 - Searching for Events in Repository Viewer

Getting Started with Repository Viewer

To open a repository, click Repositories | Open in the main menu. You are prompted to select what kind of repository to connect to: idle repository or production repository. These options mean the following:

• Production repository
  This ensures that the InTrust server you specify handles the communication between Repository Viewer and the repository. Always use this option if the repository you need is managed by an InTrust server and is available for gathering, consolidation and other operations. This method does not lock down the repository index, and multiple instances of Repository Viewer can use its index simultaneously.
• Idle repository
  This makes Repository Viewer read data directly from the repository without any intermediary components. Use this option only when the repository you need is not attached to any InTrust server. For example, it can be a backup copy of a production repository or an idle repository with historical data. Note that using direct connection locks the index of a repository so that only the first-connected instance of Repository Viewer can use the advantages of indexing.

Production repositories can be grouped together to form repository groups. A repository group acts as a single unit: you can run searches on it and create reports as if it were a regular repository. For details about repository group membership, see Managing Repository Groups.

Repository groups are stored in InTrust configuration, and they are available to every instance of Repository Viewer connected to the InTrust organization.

To open a production repository or repository group

1. Select whether you want to connect by specifying an InTrust organization or a specific InTrust server.
2. Select the organization or server.
3. Select whether you want to open individual repositories or a repository group.
   The following happens for individual repositories:
   • If you select a single repository, it will open in a temporary group. If there is still one repository in the group by the time you finish the session, the group is not saved in InTrust configuration.
   • If you select multiple individual repositories or repository groups, a new group will be created for them, and the group will open. It will include all members in your selection.

   If you select a repository group, that group will open.

You should always use the index if it is available and up to date. The index makes Repository Viewer operation interactive.

To open an idle repository

1. Specify the local or network path to the repository root folder.
2. To use the index of the repository, in the Index location group of options select Repository folder or supply a path in the This location text box. To continue without an index, select No index.

Once you have opened a repository or repository group, the left pane shows the following:

• A navigation tree with the repository structure
  The tree represents the repository structure using multiple levels, such as environment (Microsoft Windows or Unix), domain (for Windows only) and computer.
• Predefined searches with search condition presets
  These are essentially built-in interactive reports. For details, see Predefined Searches.
• Custom searches
  These are searches that you create yourself, either based on existing ones or from scratch. For details, see Custom Searches.

The right pane contains search tools.

Running Searches

To run a search, click Go. The context of your search depends on the following:

1. Where in the navigation tree you are
   Selecting a node in the navigation tree means that your searches will include only the events available at that node's level. For example, to look in the entire repository group, select the repository group node; to get events only from a particular repository or computer, select that repository or computer's node.
2. Whether you are using any parameter filters
   Running the search without any parameters will show you all events at your current navigation tree level. If you add any filters, they are applied during the search. If you have selected any search in the left pane, you are already using the filter set configured for that search.

By default, the number of search results that can be displayed at once is capped at 5000. If you reach this limit, consider specifying better filtering conditions. You can also change the search result limit on the Search Filter tab.

Predefined Searches

Repository Viewer provides an extensive set of preconfigured searches out of the box. They will likely cover most of your event analysis needs; consider trying these searches before you begin creating your own. To view and use the searches included by default, expand the Predefined Search Folders node. Predefined searches are available only when you are working with production repositories.

You can freely modify these searches in the Search Filter tab (see Filter Parameters for details). However, any changes you make are applied only for the current session. The next time you open Repository Viewer, predefined searches will be in their default state. If you want to save your changes permanently, make a copy of the modified search using the Copy To button in the toolbar of the Search Filter tab . A predefined search can be a convenient starting point for creating your own search.

In addition to the search filter configuration, the saved search includes the event list layout. If you have configured grouping and sorting for the search (see Configuring the Result Layout for details), these settings are preserved.

After you have saved your own search, all subsequent changes to it are applied immediately and permanently. See also the Custom Searches topic.

Changes to Event Fields

The set of fields in events stored in the InTrust repository has been expanded from version to version. Predefined searches in Repository Viewer have kept up with those changes and incorporated the newly-added fields. As a result, predefined searches may not always work as expected on event data that was collected by older versions of InTrust. This topic lists the added fields by InTrust version.

If your search unexpectedly turns up too little old data, you may want to modify the search to exclude recently implemented fields.

Added in Version 11.4.1 Update 1

New fields for rule match event (event ID 17408) in InTrust Server log:

Added in Version 11.4.1

New fields for Security log events that have Active Directory attributes in their descriptions:

New fields for InTrust Server log events:

Removed in Version 11.4.1

These fields were never used and have been superseded:

Added in Version 11.4

New fields for InTrust Self-Audit log events:

New fields for PowerShell log events:

New fields for Windows Security log event 4738:

Added and Changed in Version 11.3.2

New field for Windows Security log events:

Repurposed field for Windows Security log events, changed to contain textual descriptions instead of failure codes:

New fields for the Agent Management and Real-Time Service sources in InTrust Sever log events:

Added and Changed in Version 11.3.1

Added and Changed in Version 11.3

These changes mostly concern the ARS log and also, to a minor extent, Windows Security log.

Added in Version 11.1

Added in Version 11.0

Added in Version 10.7

Added in Version 10.6