Chat now with support
Chat with Support

Change Auditor 7.0.4 - Web Client User Guide

Install Change Auditor Web Client Web Client Overview Overview Page Shared Overviews Administration Page Searches Page Search Results Page Administration Tasks Page Configuration Tasks (Administration Tasks Page) Auditing Tasks (Administration Tasks Page) Protection Tasks (Administration Tasks Page) Change Auditor Client Comparison

Office 365 and Azure Active Directory auditing

Change Auditor provides extensive, customizable auditing of critical activities and provides detail alerts about vital changes taking place in Microsoft Office 365 Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory. Continually being in-the-know helps you to prove compliance, drive security, and improve uptime while proactively auditing changes to configurations and permissions.

To ensure Office 365 and Azure Active Directory compliance, you can generate intelligent, in-depth reports, protecting you against policy violations and avoiding the risks and errors associated with day-to-day modifications. By correlating activity across the on-premises and cloud environment, you can easily search all events regardless of where they occurred

To audit Office 365 Exchange Online, SharePoint Online, OneDrive for Business and Azure Active Directory you must first create an auditing template that defines the service and for Exchange Online the type of events (mailbox and administration cmdlet) to audit and the Change Auditor agent to assign. This can only be configured through the Windows client. For more information, see the Office 365 and Azure Active Directory Auditing User Guide.

SQL auditing

To enable SQL Server auditing, you must add a SQL Auditing template to an agent configuration, which can then be assigned to the appropriate agents. Change Auditor ships with a pre-defined SQL Auditing template that can be used to audit key events on the default SQL server instance or you can create a new SQL auditing template to specify the SQL instances and SQL Server operations to be audited.

The SQL Auditing page is displayed when SQL is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the SQL Auditing templates that have been defined. From this page you can launch the SQL Auditing wizard to specify the SQL instances and the operations to be audited. You can also edit existing templates, copy templates, disable/enable templates, or remove templates that are no longer being used.

2
Click Auditing.
3
Select SQL (under the Applications heading in the Auditing task list) to open the SQL Auditing page.
4
Click Add to open the SQL Auditing wizard which steps you through the process of creating a SQL Auditing template.

Welcome

Name your template.

2
Click Next.

SQL Instances

Select the SQL instance(s) to be audited.

1
Click Add to open a drop-down list and select the SQL instance to add:
Named (enter the name of the SQL instance)
2
Click Next.

SQL Events

Select the operations (facilities or event classes) that are to be audited.

Add | Add This Event to add individual events.
Add | Add All Events in Facility to add all events in the selected facility.
3
Click Next.
NOTE: Clicking Finish saves the template and closes the wizard.

SQL Column Filters

(Optional) Define column filters to capture only a subset of transactions.

2
Click Add to add it to the selection list.
3
From the selection list, click in the Operator cell to change the operator.
4
Click in the Value cell to enter the value or string to be used in the filtering.
5
Click Finish to save the template and close the wizard.

VMware auditing

To enable VMWare auditing, you must first create a VMware Auditing template which specified the VMware hosts to be audited and the agent to be used to monitor the selected VMware hosts.

The VMware Auditing page is displayed when VMware is selected from the Auditing task list in the navigation pane of the Administration Tasks page. This page contains an expandable view of all the VMware Auditing templates that have been previously defined. From this page you can launch the VMware Auditing wizard to define VMware Auditing templates specifying the VMware hosts to be audited.

2
Click Auditing.
3
Select VMware (under the Applications heading in the Auditing task list) to open the VMware Auditing page.
4
Use Add to launch the VMware Auditing wizard which steps you through the process of creating a VMware Auditing template.

Welcome

Name your template.

2
Click Next.

VMware Hosts

Select the VMware hosts to be audited.

1
Click Add to create a blank line in which to enter the IP address or name (the name entered must be resolvable) of the vCenter Server or of an individual host computer to audit.
2
To edit the port number, click in the Port cell to the right of the host name and use the arrow controls.
Click Find ESX Hosts.
Click OK to close the dialog.
4
Click Next.

Agent Selection

Select the agent to be used to monitor the selected VMware hosts and enter the credentials to be used to access the VMware hosts.

IMPORTANT: You can select an account with ‘Read-Only’ access or role (for restrictions) to properly audit VMware events. The credentials entered may be Active Directory or Linux® credentials depending on the machine (vCenter Server vs. individual host computer) selected for auditing.
1
Click Browse to open the VMware dialog.
4
Click Finish to save the template and close the wizard.

SharePoint auditing

To enable SharePoint auditing, you must deploy the Change Auditor SharePoint component to the SharePoint farms to be audited by Change Auditor, then create a SharePoint Auditing template for each SharePoint farm to be audited. The SharePoint Auditing template also defines the paths within the farm that are to be audited and specifies the agent to be used to capture the SharePoint events for the selected SharePoint farm.

The SharePoint Auditing page is displayed when SharePoint is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the SharePoint Auditing templates that have been defined. From this page you can launch the SharePoint Auditing wizard to specify the SharePoint farm and paths to be audited. You can also edit existing templates and remove templates that are no longer being used.

2
Click Auditing.
3
Select SharePoint (under the Applications heading in the Auditing task list) to open the SharePoint Auditing page.
4
Use Add to launch the SharePoint Auditing wizard which steps you through the process of creating a SharePoint Auditing template.

SharePoint Farm

Select the SharePoint farm to audit.

1
Click Find a SharePoint farm to select a SharePoint farm for auditing.
3
Click Next.

SharePoint Paths

Select the SharePoint paths to be audited and excluded from auditing.

1
Click Add at the top of the page to open the Browse SharePoint dialog.
2
On this dialog, locate and select the paths to be audited. Click OK to close the dialog and add the path(s) to the SharePoint paths to audit list (top pane).
3
(Optional) On the Add optional SharePoint paths to exclude from auditing under pane, select a path that has been added to the SharePoint paths to audit list (top pane) and then click the Add button to locate and add any subsequent paths within the selected path that are to be excluded from auditing. Click OK.
4
Click Next.

SharePoint Events

Select the operations (facilities or event classes) to be audited.

Add | Add This Event to add an individual event.
Add | Add All Events In Facility to add all events in the selected facility.
3
Click Next.

Agent Selection

Select the agent to be used to monitor the specified SharePoint farm.

1
Click Browse to display the SharePoint farm dialog.
3
Click Next.

Solution Status

Verify that the Change Auditor SharePoint Solution has been added and deployed to each SharePoint farm selected for auditing.

2
(Optional) Click the Refresh Change Auditor Solution Status button to force a refresh of the solution’s status.
3
Click Finish to save the template and close the wizard.
Related Documents