Change Auditor 7.3 - Built-in Reports Reference Guide

Table of Contents  

Introduction Built-in reports

Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365

Exchange Online OneDrive for Business SharePoint Online

Logon Activity Skype for Business Recommended Best Practices

Auditing Service Administrator Activity

Domain Wide Configuration Activity | Domain Admins Forest Changes by Activity Forest Wide Configuration Activity | Enterprise Admins Forest Wide Configuration Activity | Schema Admins Service Admins Group Membership

Domain Controller Changes Domain-Level Changes Exchange Forest-Level Changes Severity Based Changes SQL

Regulatory Compliance

FISMA (Federal Information Security Management Act)

NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption

GLBA (Gramm-Leach-Bliley Act)

6801 – Protection of Non Public Personal Information | 6801(a) – Privacy Obligation Policy 6805 – Enforcement | 6805(b) – Enforcement of Section 6801

GDPR

Administrative Control Audit and Accountability Responsibility of the Controller Integrity and Confidentiality Security of Processing

HIPAA (Health Insurance Portability and Accountability Act)

164.308 – Administrative Safeguards | Security Management 164.308 – Administrative Safeguards | Workforce Security 164.308 – Administrative Safeguards | Information Access Management 164.308 – Administrative Safeguards | Security Awareness and Training 164.310 – Physical Safeguards | Standard Workstation Security 164.310 – Physical Safeguards | Standard Workstation Use 164.312 – Technical Safeguards | Standard Person or entity authentication 164.312 – Technical Safeguards | Standard Access Control 164.312 – Technical Safeguards | Standard Audit Control

Payment Card Industry

Build and Maintain a Secure Network and Systems Implement Strong Access Control Measures Maintain a Vulnerability Management Program Regularly Monitor and Test Networks

SAS 70 (Statement on Auditing Standards, Service Organizations)

Service Auditor's Reports: Type I

SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)

Section 404 | Acquisition and Implementation BAI2.2 - Perform a feasibility study and formulate alternative solutions Section 404 | Delivery and Support

Security

Access Control - Administrator Account Activity Access Control - Administrator Group Activity Access Control - File System Access Management Computer Activity Computer Management Critical GPO Changes Domain Controller Security

Domain Controller Configuration Changes

Domain Security Exchange Group Activity Group Management Organizational Unit Management

Group Policy Changed last 30 days

Severity Based Changes Trust Activity User Activity User Management

SharePoint SQL Data Level SQL Extended Events Threat Detection

• Viewing Topics 65 - 68 of 109

A summary report containing events from all of the following reports.

164.308 – Administrative Safeguards | Information Access Management

| Information Access Management