Change Auditor 7.5 - User Guide

Introduction

Introduction

You can search, report and alert on changes to a specific file or folder. Using Change Auditor for Windows File Servers you can receive real-time alerts whenever someone tries to access a secure file or folder.

 

Create custom File System search

Create custom File System search

The following scenario explains how to use the What tab to create a custom File System search.

 

NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria: • Who - allows you to search for events generated by a specific user, computer or group • Where - allows you to search for events captured by a specific agent or within a specific domain or site • When - allows you to search for events that occurred within a specific date/time range • Origin - allows you to search for events that originated from a specific workstation or server

To search for all file system events:

1	Open the Searches page.

2	In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.

3	Click New at the top of the Searches page.

This will activate the Search Properties tabs across the bottom of the Searches page.

4	On the Info tab, enter a name and description for the search.

5	Open the What tab, expand Add and select Subsystem | File System.

6	On the Add File System Path dialog, select one of the following options to define the scope of coverage:

▪	All File System Paths - select to include all file system paths

▪	This Object - select to include only the selected objects

▪	This Object and Child Objects Only - select to include the selected objects and its direct child objects

▪	This Object and All Child Objects - select to include the selected objects and all subordinate objects (in all levels)

7	By default, All Actions is selected meaning that all of the actions associated with the file system path will be included in the search. However, you can clear the All Actions option and select individual options to include specific actions in your search definition.

The options available are:

▪	All Actions - select to include all of the actions (Default)

▪	Add - select to include when a File System folder or file is added

▪	Delete - select to include when a File System folder or file is deleted

▪	Move - select to include when a File System folder or file is moved

▪	Rename - select to include when a File System folder or file is renamed

▪	Modify - select to include when a File System folder or file is modified

▪	Other - select to include when any other type of activity occurs on a File System folder or file

8	If you selected a scope other than All File System Paths, select the type of file system paths to be included in the search:

▪	All Types - select to search all of the file system path types listed

▪	File - select to search only files

▪	Folder - select to search only folders

▪	Transaction - select to audit changes that were committed or rolled back within a transaction

NOTE: If the All Types check box is selected by default, you must clear this check box before you can select any of the other options.

9	If you selected a scope other than All File System Paths, enter or use the browse button to select the file or folder to be searched. Once you have entered a file or folder in the Path field, click Add to add the file/folder to the File System list.

NOTE: Select the Exclude the Above Selection(s) check box if you want to search for all file system files or folders EXCEPT those listed in the ‘what’ list.

NOTE: Select the Runtime Prompt check box on this dialog to prompt for a file system path every time the search is run.

10	Once you have selected the file system paths to be included in the search, click OK to save your selection and close the dialog.

11	Once you have defined the search criteria, you can either save the search definition or run the search.

▪	To save the search definition without running it, click Save.

▪	To save and run the search, click Run.

12	When this search runs, Change Auditor searches for the file system events based on the search criteria specified on the What tab and display the results in a new search results page.

File System Protection

File System Protection

•	Introduction

•	File System Protection page

•	File System Protection templates

•	File System Protection wizard

Introduction

Introduction

When licensed, Change Auditor for Windows File Servers also provides an access control model that permits administrators to secure business-critical files and folders on the file server against potentially dangerous changes.

NOTE: File System protection is designed to provide protection coverage for a small number of business-critical files/folders. Protecting an entire drive or a large portion of a drive is not recommended and has the potential of causing performance impacts and poor user experience.

To use file system protection, you must first define the files/folders to protect:

1	Create a File System Protection template which specifies the files/folders to be protected.

2	Add this template to an agent configuration.

3	Assign the agent configuration to Change Auditor agents.