Chat now with support
Chat with Support

Change Auditor 7.1.1 - Release Notes

Authentication Services auditing

Table 23. Authentication Services auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for Authentication Services

Authentication Services -Latest supported version

Authentication Services 4.2

For more information

See the Change Auditor for Authentication Services User Guide.

Defender auditing

Defender auditing
Table 24. Defender auditing requirements
Components
Supported Versions

Change Auditor

Change Auditor for Defender

Defender — Latest supported version

Defender 5.9.6

For more information

See the Change Auditor for Defender User Guide.

EMC auditing

Table 25. EMC auditing requirements
Component
Supported Version

Change Auditor

Change Auditor for EMC

NOTE: Change Auditor for EMC 6.5 (or higher) is required for EMC Isilon auditing.

EMC Celerra/VNX - Supported up to the following versions

EMC Common Event Enabler (CEE) Framework up to 8.7.0

NOTE: CEE requires .NET Framework 3.5 for EMC auditing. Ensure that it is installed on the computer where you have installed CEE.

EMC Celerra Event Enabler (CEE) Framework 4.6.7

EMC VNX Event Enabled (VEE) Framework 4.8.5 (through 5.1)

NOTE: VNXe is NOT supported. VNXe does not support CEPA currently and therefore Change Auditor for EMC does not run successfully in VNXe environments.
NOTE: Starting with release 6.0.0.0, the VNX Event Enabler (VEE) is called the Common Event Enabler (CEE).

EMC Isilon - Supported up to the following versions

EMC Common Event Enabler (CEE) Framework up to 8.7.0

NOTE: CEE requires .NET Framework 3.5 for EMC auditing. Ensure that it is installed on the computer where you have installed CEE.
NOTE: Isilon Server pre-configured for auditing. See the EMC User Guide for more information.

EMC Unity - Supported up to the following versions

EMC Unity 5.0.0

EMC Common Event Enabler (CEE) Framework up to 8.7.0

To enable auditing, you must configure CEE using EMC Unisphere:

•
Select STORAGE | File | NAS Servers. Open the server properties and select Event Publishing. Select to Enabling Common Event Publishing. Add the CEPA Server where the CEE is installed, select All Events, and save the settings.
•
Select File System you want to audit and choose the Advanced tab. Under the Events Notifications, select Enable SMB Events publishing.
NOTE: When auditing EMC Unity using an agent on Windows Server 2019, the lowest supported version is EMC Unity 4.4.1.

Agent

Locate the Change Auditor agent near the EMC device (use fastest connection type available).

•
Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored EMC device and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.

Use multiple CPU hosts for Change Auditor agent service (at least 2 CPUs or 2 CPU core).

Rights and permissions
•
Administrative rights on the EMC Control Station to create or modify the cepp.conf file on the EMC file server (CIFS).
•
The computer account where the Change Auditor agent is running must have permissions on the EMC Virus Checking policy.

For more information

See the Change Auditor for EMC User Guide for detailed information about installing, configuring, and using Change Auditor for EMC.

NetApp auditing

Table 26. NetApp auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for NetApp

NetApp Filer

NetApp Filer with Data ONTAP 7.2 to 9.7

Cluster mode is supported as of version 8.2.1

NOTE: NetApp events initiated through the NFS protocol are not supported.

Agent

•
Locate a Change Auditor agent close to the NetApp filer (use fastest connection type available).
•
Quest recommends to have 1 Gbps network connectivity (or faster connection type) between the monitored NetApp filer and the computer where the Change Auditor agent service is running. Use a direct or one-switch connection.
•
Use a multiple CPU host for Change Auditor agent service (at least 2 CPUs or 2 CPU core).
•
In order for the NetApp filer to properly send events to the Change Auditor agent, reverse DNS zone must be configured for the Change Auditor agent server’s IP address. This can be configured in the Reverse Lookup Zone of the DNS server used by the NetApp filer. To verify you can look up a Change Auditor agent using its IP address, use the nslookup command as illustrated below:
•
If Windows Firewall is enabled on the server hosting the Change Auditor agent responsible for capturing the NetApp events, it must be configured to allow ‘File sharing’.

Required rights and permissions

NetApp running in 7-mode

The provided credentials must have local Administrator rights on the monitored NetApp filer.

You can specify these credentials in one of two ways for the Change Auditor agents assigned to the NetApp Auditing template which defines what to audit on the selected NetApp filer:

•
Add the Change Auditor agent service account to the local Administrators group on the NetApp filer.
•
Use the Set Credentials button on the NetApp Auditing template to specify the NetApp filer credentials to be used by the selected Change Auditor agent. If you use this method, the specified account must be an Active Directory user that is a member of the local Administrators group of the NetApp filer.
NOTE: Enable TLS communication on the filer to allow secure communication with the Change Auditor client using the following command: options tls.enable on

Rights and permissions

NetApp running in cluster mode

Use the Set Credentials button on the NetApp Auditing template. The account should be an Active Directory user that is a member of the local Administrators group of the NetApp filer.

To grant ONTAPI access for the NetApp cluster for an Active Directory user, run the following command on the cluster console:

security login create –vserver <vservername> -username <domain\username> -application ontapi -authmethod domain -role <rolename>

Optionally, you can use the default role “vsadmin” as the rolename which has the administrator permissions of the NetApp filer.

To create a new role and assign the minimum required rights, run the following commands:

security login role create -vserver <vservername> -role <rolename> -cmddirname "version" -access all
security login role create -vserver <vservername> -role <rolename> -cmddirname "volume" -access readonly
security login role create -vserver <vservername> -role <rolename> -cmddirname "vserver fpolicy" -access all
NOTE: domain\username and password are case-sensitive, so the credentials used with the NetApp auditing template must match.

See the NetApp user guide for more details on enabling Active Directory domain users access to the cluster.

To add a new account to a NetApp filer’s local Administrators group:
1
Open Active Directory Users and Computers MMC snap-in.
2
Select the domain where the NetApp filer is located.
3
Select Computers from the tree and then select the filer from the list in the right pane.
By default, the computer name is the same as the filer name. The actual container and the computer names are configured during CIFS setup on the filer.
4
Right-click the filer and click Manage. The Computer Management console opens.
5
Select System Tools | Local Users and Groups | Groups.
6
Double-click the Administrators group on the right.
7
Click Add to add an account to the Administrators group.

For more information

See the Change Auditor for NetApp User Guide for detailed information about installing, configuring, and using Change Auditor for NetApp.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating