Chat now with support
Chat with Support

Change Auditor 7.1 - SIEM Integration User Guide

Integrating Change Auditor and SIEM Tools Subscription Management Webhook technical insights

Subscription Management

•
Adding the PowerShell module
•
Viewing available commands and help
•
Connecting to Change Auditor
•
Managing subscriptions
•
Managing a Splunk integration
•
Managing an IBM QRadar integration
•
Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration
•
Managing a Quest IT Security Search integration (Preview)

 

Adding the PowerShell module

Change Auditor comes with a PowerShell module for you to use to manage your environment. It is installed when you install the Windows client or a coordinator.

* 
NOTE: Windows PowerShell version 3.0 or higher is required.
To import the Change Auditor PowerShell module:
1
Open a Windows PowerShell window and type the following at the Windows PowerShell command prompt:
Import-Module <path>
Where "<path>" is the file path for the ChangeAuditor.PowerShell.dll assembly found in the Change Auditor Windows client or Change Auditor coordinator folder.
2
To ensure that the module was added, type the following at the Windows PowerShell command prompt:
Get-Module -All
The registered PowerShell modules are listed.

Viewing available commands and help

•
To view all available Change Auditor commands, enter:
Get-Command -Module ChangeAuditor.PowerShell
•
To view help on each command including the syntax, enter:
Get-Help cmdletName
•
To view an interactive command browser that shows you the layout of commands and the help for the commands, enter:
Show-Command cmdletName

 

* 
NOTE: Sample scripts are available in the Change Auditor client folder. By default they are located here: C:\Program Files\Quest\ChangeAuditor\Client\PowerShell Sample Scripts

Connecting to Change Auditor

Most Change Auditor commands require a connection to a coordinator. You can make multiple connections to different coordinators or deployments in the same script as long as the version of Change Auditor is the same.

Example: Connect to the installation “XYZ” in the local forest
* 
NOTE: This allows for fault tolerance if you have numerous coordinators by selecting the best option in the domain.

Connect-CAClient –InstallationName ‘XYZ’ -DomainName 'DomainName.com'

 

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating