Chat now with support
Chat with Support

Change Auditor for Defender 7.2 - User Guide

Defender Searches/Reports

Defender built-in searches

You can run built-in searches to retrieve Defender activity captured by deployed agents enabling you to retrieve valuable information from a variety of perspectives.

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.


Click on the Searches tab or select View | Searches.
NOTE: To modify a built-in search, see the Change Auditor User Guide.

Search results

The Defender event information (including key information like who, what, when, where, why, and the event origin information) can be viewed on the Event Details pane in the client. The following table provides a description of the event details provided for Defender events.


Displays “Low”, “Medium”, or “High” depending on the event.


Specifies the name of the user who initiated the change.


Specifies the date and time when the change occurred.


Displays the name of the workstation where the change occurred.


Displays ‘Change Auditor’ which is the application from which the event was retrieved.


Displays the NetBIOS name and IP address of the workstation from which the event was generated.


Displays a description of the activity that occurred.


Displays that it is Defender activity.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating