Chat now with support
Chat with Support

Change Auditor 7.1.1 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level Threat Detection VMware

Forest-Level Changes

Changes in forest-wide operations master roles
Who = All Users
What = Domain FSMO Role Owner Moved; Schema FSMO Role Owner Moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in LDAP policies
Who = All Users
What = Default Site Query Policy Object Changed; Linked Query Policy Object for Domain Controller Changed; Linked Query Policy for Site Changed; Query Policy Added; Query Policy Link for Domain Controller Changed; Query Policy Removed; Query Policy Setting Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in replication topology
Who = All Users
What = Replication Transport facility; Site Configuration facility; Site Link Bridge Configuration facility; Site Link Configuration facility; Subnets facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in the GPO assignments for all Sites
Who = All Users
What = Group Policy Link Added to Site; Group Policy Link Removed from Site; Group Policy Block Inheritance Setting Changed on Site; Group Policy No Override Setting Changed on Site; Group Policy Disabled Setting on Site Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Changes in the GPOs linked to all Sites
Who = All Users
What = Linked Group Policy on Site Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Promotion or demotion of domain controllers
Who = All Users
What = Domain Controller Added to Domain; Domain Controller Removed from Domain; Domain Controller Renamed; GC Added; GC Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Schema Changes
Who = All Users
What = Schema Configuration facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Severity Based Changes

High Severity changes in last 30 days
Who = All Users
What = Severity | High
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Low Severity changes in last 30 days
Who = All Users
What = Severity | Low
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Medium Severity changes in last 30 days
Who = All Users
What = Severity | Medium
Where = All sources
When = Last 30 days
Origin = All workstations/servers

SQL

All SQL Add Roles, User, and Login Events in the last 24 hours
Who = All Users
What = Audit Add DB User; Audit Add Login; Audit Add Login to Server Role; Audit Add Member to DB Role; Audit Add Role
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Broker Events in the last 24 hours
Who = All Users
What = SQL Broker Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL CLR Events in the last 24 hours
Who = All Users
What = SQL CLR Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Cursors Events in the last 24 hours
Who = All Users
What = SQL Cursors Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Database Events in the last 24 hours
Who = All Users
What = SQL Database Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Deprecation Events in the last 24 hours
Who = All Users
What = SQL Deprecation Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Errors and Warning Events in the last 24 hours
Who = All Users
What = SQL Errors and Warnings Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Events
Who = All Users
What = SQL subsystem
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Events in the last 24 hours
Who = All Users
What = SQL subsystem
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Full Text Events in the last 24 hours
Who = All Users
What = SQL Full Text Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Internal Auditing Events in the last 24 hours
Who = All Users
What = Auditing Disabled for SQL Instance; Auditing Enabled for SQL Instance; SQL Auditing Template Added; SQL Auditing Template Added to Agent Configuration; SQL Auditing Template Changed; SQL Auditing Template Disabled; SQL Auditing Template Enabled; SQL Auditing Template Removed; SQL Auditing Template Removed from Agent Configuration; SQL Instance Added; SQL Instance Changed; SQL Instance Removed; SQL Reporting Services Template Added; SQL Reporting Services Template Changed; SQL Reporting Services Template Disabled; SQL Reporting Services Template Enabled; SQL Reporting Services Template Removed
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Lock Events in the last 24 hours
Who = All Users
What = SQL Locks Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Objects Events in the last 24 hours
Who = All Users
What = SQL Objects Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL OLEDB Events in the last 24 hours
Who = All Users
What = SQL OLEDB Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Performance Events in the last 24 hours
Who = All Users
What = SQL Performance Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Progress Report Events in the last 24 hours
Who = All Users
What = SQL Progress Report Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Query Notification Events in the last 24 hours
Who = All Users
What = SQL Query Notifications Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Scan Events in the last 24 hours
Who = All Users
What = SQL Scans Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Security Audit Events in the last 24 hours
Who = All Users
What = SQL Security Audit Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Server Events in the last 24 hours
Who = All Users
What = SQL Server Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Session Events in the last 24 hours
Who = All Users
What = SQL Session Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Stored Procedures Events in the last 24 hours
Who = All Users
What = SQL Stored Procedures Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL Transaction Events in the last 24 hours
Who = All Users
What = SQL Transactions Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL TSQL Events in the last 24 hours
Who = All Users
What = SQL TSQL Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All SQL User-Configuration Events in the last 24 hours
Who = All Users
What = SQL User-Configurable Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Audit Access DB Object Changed
Who = All Users
What = Audit Access Database Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Add DB User
Who = All Users
What = Audit Add DB User
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Add Login
Who = All Users
What = Audit Add Login
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Add Login to Server Role
Who = All Users
What = Audit Add Login to Server Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Add Member to DB Role
Who = All Users
What = Audit Add Member to DB Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Add Role
Who = All Users
What = Audit Add Role
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Database
Who = All Users
What = Audit Alter Database
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Database Object
Who = All Users
What = Audit Alter Database Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Database Principal
Who = All Users
What = Audit Alter Database Principal
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Object Derived Permission
Who = All Users
What = Audit Alter Object Derived Permission
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Schema Object
Who = All Users
What = Audit Alter Schema Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Server Object
Who = All Users
What = Audit Alter Server Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Alter Server Principal
Who = All Users
What = Audit Alter Server Principal
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Drop Database
Who = All Users
What = Audit Drop Database
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Audit Drop DB User
Who = All Users
What = Audit Drop DB User
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Data File Auto Grow Changed
Who = All Users
What = Data File Auto Grow
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Database Mirroring State Changed
Who = All Users
What = Database Mirroring State Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Full Text Crawl Aborted
Who = All Users
What = FT: Crawl Aborted
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Full Text Crawl Started
Who = All Users
What = FT: Crawl Started
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Full Text Crawl Stopped
Who = All Users
What = FT: Crawl Stopped
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Data File Auto Shrink Changed
Who = All Users
What = Data File Auto Shrink
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Error Logged
Who = All Users
What = Error Logged
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Event Logged
Who = All Users
What = Event Logged
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Lock Canceled
Who = All Users
What = Lock: Cancel
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Lock Released
Who = All Users
What = Lock: Released
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Locked Acquire
Who = All Users
What = Lock: Acquired
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Transaction Begin
Who = All Users
What = SQL Transaction Begin
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Transaction Commit
Who = All Users
What = SQL Transaction Commit
Where = All sources
When = Last 7 days
Origin = All workstations/servers
SQL Transaction Rollback
Who = All Users
What = SQL Transaction Rollback
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Regulatory Compliance

The Regulatory Compliance reports are available under the following folders:

•
FISMA (Federal Information Security Management Act)
•
GLBA (Gramm-Leach-Bliley Act)
•
GDPR
•
HIPAA (Health Insurance Portability and Accountability Act)
•
Payment Card Industry
•
SAS 70 (Statement on Auditing Standards, Service Organizations)
•
SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating