Chat now with support
Chat with Support

Quest has tools and processes in place to identify, protect, detect, and remediate vulnerabilities and incidents when they occur, including external security partners. As part of our standard security operations, Quest does not use CrowdStrike in any of our operations. We are reviewing our third parties, and so far, there is minimal affect. It is Quest's policy not to provide further technical details unless they directly impact customer data.

Change Auditor 7.4 - Whats New

What's New in Change Auditor 7.4 What's New in Change Auditor 7.3 What's New in Change Auditor 7.2 What's New in Change Auditor 7.1.1 What's New in Change Auditor 7.1 What's New in Change Auditor 7.0.4 What's New in Change Auditor 7.0.3 What's New in Change Auditor 7.0.2 What's New in Change Auditor 7.0.1 What's New in Change Auditor 7.0

What's New in Change Auditor 7.0.2

What’s New in Change Auditor 7.0.2

As a result of ongoing research and development, and in response to customer feedback, the following enhancements have been made in this release of Quest Change Auditor.

•
Threat Detection updates and enhancements
•
SIEM subscription updates and enhancements
•
Additional PowerShell commands
•
Ability to search based on authentication type and port
•
Enhanced security between Change Auditor components (FIPS compliance)
•
Azure Active Directory and Office 365 enhancements
•
Additional platform support
•
Miscellaneous features and enhancements

 

Threat Detection updates and enhancements

The following updates are included for your Threat Detection deployment:

•
Access to an update script and configuration commands to easily upgrade the Threat Detection server.
•
Support for deploying the Threat Detection server on Hyper-V.
•
Ability to enable single sign-on access for the Threat Detection dashboard.
•
Ability to specify a root password during the Threat Detection server deployment.
•
Ability to review the Threat Detection configuration status in the Change Auditor client (configuration page).
•
New events listed under the “Threat Detection - Risky User" facility and the "Threat Detection - Alert" facility:
•
Risky user identified
•
Risky user severity increased
•
Risky user severity decreased
•
Threat Detection alert added
•
Threat Detection alert marked as "actual risk"
•
Threat Detection alert marked as "not a risk"
•
Additional events details including:
•
Alert name, score, severity, and the number of alerts.
•
When the Threat Detection server started processing the alert.
•
Name of indicators associated with the alert.
•
User risk score and severity.
•
The number of points the alert adds to the user risk score (contribution to user score ).
•
Old and new severity values.
•
Tags that identify whether the user is an administrator or a watched user.
•
Comments that identify when an alert is set to 'not a risk’ or 'actual risk’.
•
A link to the Threat Detection dashboard from the event details pane to quickly gain more information on the potential threat.
•
Additional built-in searches:
•
All Threat Detection events in the last 7 days.
•
All Threat Detection risky user events in the last 7 days.
•
All Threat Detection alert events in the last 7 days.
•
All Threat Detection risky user and alert events in the last 24 hours.

SIEM subscription updates and enhancements

The following features have been added to improve your SIEM tool integrations:

•
Ability to modify the subsystems included in a SIEM subscription.
•
Ability to encrypt QRadar subscriptions with TLS/SSL.
•
Ability to include and display the raw JSON event details provided by Microsoft for Office 365 and Azure Active Directory events.
•
Ability to forward events to Quest IT Security Search (Preview mode).

Additional PowerShell commands

The following commands are available to help you manage your Change Auditor deployment:

Table 1. PowerShell commands
Function
Command

Assign, remove, and get an auditing template for a Change Auditor configuration.
•
Add-CATemplateToConfiguration
•
Remove-CATemplateFromConfiguration
•
Get-CAConfigurationTemplates

Assign an auditing configuration to a Change Auditor agent.
•
Set-CAAgentConfiguration

Run a search.
•
Invoke-CASearch

Manage Windows file system auditing.

 
•
New-CAWindowsFSAuditObject
•
New-CAWindowsFSAuditTemplate
•
Remove-CAWindowsFSAuditTemplate
•
Set-CAWindowsFSAuditTemplate,
•
Get-CAWindowsFSAuditTemplates
•
Get-CAWindowsFSEventClassInfo

Create and manage a Quest IT Security Search event subscription.

These commands are in preview mode for this release.

•
New-CAITSSEventSubscription
•
Get-CAITSSEventSubscriptions
•
Set-CAITSSEventSubscription
•
Remove-CAITSSEventSubscription
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating