Change Auditor 7.5 - User Guide

Exchange Searches and Reports

Exchange Searches and Reports

•	Introduction

•	Run the All Exchange Events report

•	Create custom Exchange searches

Introduction

Introduction

Change Auditor delivers both preconfigured and customizable reports displaying events from Exchange servers in one centralized viewer. Change Auditor for Exchange provides two subsystems related to Exchange auditing:

•	The Exchange subsystem is used for administration, searching and reporting on the Exchange events contained in the following facilities:

▪	Exchange ActiveSync Monitoring

▪	Exchange Administrative Group

▪	Exchange Distribution List

▪	Exchange Mailbox Monitoring

▪	Exchange Organization

▪	Exchange Permission Tracking

▪	Exchange User

•	The Microsoft 365 subsystem is used for administrators, searching and reporting on events contained in the following facilities:

▪	Microsoft 365 Exchange Online Administration

▪	Microsoft 365 Exchange Online Mailbox

NOTE: See the Microsoft 365 and Microsoft Entra ID Auditing User Guide for details.

Run the All Exchange Events report

Run the All Exchange Events report

Running this report retrieves the Exchange events captured on all Exchange servers hosting a Change Auditor agent.

NOTE: This query uses the Exchange subsystem; therefore, it returns all Exchange events except for Microsoft 365 Exchange Online events.

1	Open the client and the Searches tab.

2	In the explorer view (left pane), expand the Shared | Built-in | All Events folder.

3	Locate and double-click All Exchange Events.

This displays a new Search Results page displaying the Exchange events captured over the last seven days.

 

NOTE: To retrieve the Exchange events captured over the last 24 hours, use the All Exchange Events in the last 24 hours report under the Shared | Built-In | Recommended Best Practice | Exchange folder.

Create custom Exchange searches

Create custom Exchange searches

The following scenarios explain how to use the What tab to create custom Exchange searches.

NOTE: You can use the other search properties tabs to define more criteria: • Who - allows you to search for events generated by a specific user • Where - allows you to search for events captured by a specific agent • When - allows you to search for events that occurred within a specific date/time range • Origin - allows you to search for events that originated from a specific workstation or server

To search for changes to a specific Exchange container:

1	Open the Searches page.

2	In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder creates a search that only you can run and view, whereas selecting the Shared folder crates a search which can be run and viewed by all Change Auditor users.

3	Click New to enable the Search Properties tabs across the bottom of the Searches page.

4	On the Info tab, enter a name and description for the search.

5	On the What tab, expand Add and click Subsystem | Exchange to display the Add Exchange Container dialog.

NOTE: You can use Add with Events | Subsystem | Exchange to search for an entity that already has an event associated with it in the database.

6	On the Add Exchange Container dialog, select one of the following options to define the scope of coverage:

▪	All Exchange Objects - select to include all objects. (Default when Add is used.)

▪	This Object - select to include the selected objects only. (Default when Add With Events is used.)

▪	This Object and Child Objects Only - select to include the selected objects and its direct child objects.

▪	This Object and All Child Objects - select to include the selected objects and all subordinate objects (in all levels).

▪	Members of this group - select this option to show changes made to users in a specified group. Nested groups are not supported.

NOTE: You cannot exclude selections or use the *Like wildcard option when the scope is specified as Members of this group.

7	By default, All Actions is selected meaning that all the activity associated with the object generates an audited event. However, you can clear the All Actions option and select individual options. The options available are:

▪	All Actions - select to include when any of the following actions occur (Default)

▪	Add Attribute - select to include when an attribute is added

▪	Delete Attribute - select to include when an attribute is deleted

▪	Modify Attribute - select to include when an attribute is modified

▪	Rename Object - select to include when an object is renamed

▪	Add Object - select to include when an object is added

▪	Delete Object - select to include when an object is deleted

▪	Move Object - select to include when an object is moved

▪	Other - select to include other types of activity against the selected object

8	By default, All Transports is selected indicating that all Exchange events regardless of the transport protocol used are included in the search. However, you can clear the All Transports option and select individual options. The transport options available are:

▪	All Transports - select to include Exchange events regardless of the transport protocol used (Default)

▪	All Transports - select to include LDAP operation or LDAP queries regardless of the transport protocol used (Default)

▪	SSL/TLS - select to include LDAP operation or LDAP queries that are secured using SSL or TLS technology

▪	Kerberos- select to include LDAP operation or LDAP queries that are signed using Kerberos-based encryption

▪	Simple Bind - select to include LDAP operation or LDAP queries that are secured using simple bind authentication (neither SSL\TLS or Kerberos used)

▪	Port - select to identify a specific port used for communication

NOTE: When you clear the All Transports check box and select both the SSL/TLS and Kerberos check boxes, only AD queries using both of these transport protocols will be included in the search results.

9	When a scope other than All Exchange Objects is selected, the directory object picker is enabled to select the objects to include in the search definition.

Use either the Browse or Search page to locate and select the Exchange containers to include.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

Use the Options page to view or modify the search options to retrieve directory objects.

You can also select Import Objects to import a .csv (comma separated value) file containing a list of directory objects. Using this list, you can specify object names and optional values for the search criteria. You can use the * wildcard character to match any string of zero or more characters when specifying the Name values.

NOTE: For optimal performance, do not include more than 1000 objects in your import file.

The import will fail and an error message will be displayed if any errors are detected with the column names or specified values.

NOTE: Column names and values must be separated with a comma.

NOTE: If an optional column name is not specified, then the default All is used for the value for each object. The default All is also used if the optional column is specified, but the value is empty. Mandatory Name values cannot be empty.

Columns	Description
Name (Required)	The name of the directory object to import. Name values must be specified in canonical name format. NOTE: The first column must be Name. NOTE: Wildcard characters are only supported for the Name values. Examples: Column: Name Values: • test.domain.ca/OU1/User1 • test.domain.ca/*/Group1 • test.domain.ca/OU1/*User*
Actions (Optional)	Possible values include: Add Attribute, Delete Attribute, Modify Attribute, Rename Object, Add Object, Delete Object, Move Object or Other. When specifying multiple values they must be separated by the Pipe character '|'. Examples: Columns: Name,Actions Values: • test.domain.ca/OU1/User1,Move Object|Modify Attribute • test.domain.ca/OU1/Group*,
Transports (Optional)	Possible values include SSL/TLS, Kerberos or Simple Bind. When specifying multiple values they must be separated by the Pipe character '|'. Examples: Columns: Name,Actions,Transports Values: • test.domain.ca/OU1/User1,Move Object|Modify Attribute,Kerberos • test.domain.ca/OU1/Group1,,Kerberos |SSL/TLS
Port (Optional)	The number of the required port. Examples: Columns: Name,Actions,Transports,Port Values: • test.domain.ca/OU1/*,Move Object|Modify Attribute,Kerberos,389 • test.domain.ca/OU1/Group1,Add Attribue,Kerberos, NOTE: When importing a file in the web client, the default value (All Ports) will be applied if port values are specified.

 

NOTE: Select the Exclude the Above Selection(s) check box if you want to search for changes to all Exchange containers except those listed in the ‘what’ list.

NOTE: Select the Runtime Prompt check box on this dialog to prompt for an Exchange container every time the search is run.

10	After you have added all the Exchange containers to include in the search, click OK to save your selection and close the dialog.

11	Once you have defined the search criteria, you can either save the search definition or run the search.

▪	To save the search definition without running it, click Save.

▪	To save and run the search, click Run.

12	When this search runs, Change Auditor searches for changes to the Exchange containers specified on the What tab.

To search for changes to an Exchange object using a wildcard expression:

1	Open the Searches page.

2	In the explorer view (left pane), expand and select the folder where you want to save your search.

Selecting the Private folder creates a search that only you can run and view, whereas selecting the Shared folder creates a search which can be run and viewed by all Change Auditor users.

3	Click New at the top of the Searches page to activate the Search Properties tabs across the bottom of the Searches page.

4	On the Info tab, enter a name and description for the search.

5	On the What tab, expand Add and click Subsystem | Exchange.

6	On the Add Exchange Container dialog, select the This Object scope.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

7	Use the wildcard expression fields in the middle of the dialog to specify the expression to use to search for Exchange objects (Object Name column in Search Results grid).

▪	Select the comparison operator: Like or Not Like.

▪	In the field to the right, enter the pattern (character string and * wildcard character) to use to search for a match.

Use the * wildcard character to match any zero or more characters. For example: LIKE *admin* finds Exchange objects that contain ‘admin’ anywhere in their name.

▪	Click Add to add the wildcard expression to the Selected Objects list box at the bottom of the dialog.

8	After entering the wildcard expression to use, click OK to close the dialog and add the wildcard expression to the ‘What’ list.

9	Once you have defined the search criteria, you can either save the search definition or run the search.

▪	To save the search definition without running it, click Save.

▪	To save and run the search, click Run.

10	When this search runs, Change Auditor searches for changes to the Exchange containers specified on the What tab.