Chat now with support
Chat with Support

Change Auditor 7.1.1 - Web Client User Guide

Install Change Auditor Web Client Web Client Overview Overview Page Shared Overviews Administration Page Searches Page Search Results Page Administration Tasks Page Configuration Tasks (Administration Tasks Page) Auditing Tasks (Administration Tasks Page) Protection Tasks (Administration Tasks Page) Change Auditor Client Comparison

Auditing Tasks (Administration Tasks Page)

•
Introduction
•
Configuration
•
Forest
•
Applications
•
Server
•
NAS

Introduction

The following sections describe the pages and tasks available through the Auditing task list of the Administration Task page. The auditing pages allow you to enable and disable events, define custom auditing definitions for your Active Directory forest, define auditing for different types of applications within your environment, create auditing templates that can then be assigned to agent configurations to enable custom server-level auditing, and create auditing templates for NAS devices. For a full description of all the options and fields available on the Auditing tasks pages, refer to the appropriate Change Auditor user guide.

The Auditing task list is divided into the following separate task lists:

•
Configuration
•
Audit Events
•
Excluded Accounts auditing
•
Forest
•
Active Directory auditing
•
AD Attribute Auditing page
•
Member of Group Auditing page
•
AD Query Auditing page
•
ADAM (AD LDS) auditing
•
ADAM (AD LDS) Auditing page
•
ADAM (AD LDS) Attribute Auditing page
•
Applications
•
Exchange Mailbox auditing
•
Office 365 and Azure Active Directory auditing
•
SQL auditing
•
VMware auditing
•
SharePoint auditing
•
Server
•
File System auditing
•
Registry auditing
•
Services auditing
•
NAS
•
EMC auditing
•
NetApp auditing
•
Fluid File System (FluidFS) auditing
* 
NOTE: Authorization to use the administration tasks on the Administration Tasks page is defined using the Application User Interface page. If you are denied access to the tasks on any of these pages, refer to Application User Interface Authorization page.

Configuration

The tasks under this heading are used for configuring the events to captured and the accounts to exclude from auditing.

See the following administration task descriptions for more information:

•
Audit Events
•
Excluded Accounts auditing

Audit Events

You can enable and disable the auditing of individual events so that Change Auditor audits only those events that are vital to your organization’s operation. In addition, you can modify the severity level (high, medium, or low) and description assigned to each event. Change Auditor uses the severity level when processing events to help you in determining the potential level of risk associated with each configuration change event.

Audit Events page

The Audit Events page is displayed when Audit Events is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and it lists all the events available for auditing by Change Auditor. It displays the facility to which the event belongs, the event severity, if the event is enabled or disabled and the required Change Auditor license.

* 
NOTE: Changes made on this page are global and apply to all agents.
* 
NOTE: For more information, including a full description of the page, refer to the Change Auditor User Guide.

 

 
Table 31. Audit Events page: Tool bar buttons
Tool bar buttons
Description

Columns

Use to display different fields on the Audit Events page.

Edit

Use to edit the description of the selected event.

High | Medium | Low

Use to change the severity of the selected event.

Enable

Use to enable the selected event.

Disable

Use to disable the selected event.

Default

Use to reset the selected event’s severity, description, and enable or disable status back to the factory defaults.

Knowledge Base

Use to launch the knowledge base entry for the selected event.

Right-click commands are also available when you right-click an event in the grid. In addition to the event-related actions, you can also change the results criteria for capturing an event.

To change the results criteria for capturing an event:
1
Open the Audit Events page.
2
Right-click the event to modify and select one of the following options:
•
All Results (default)
•
Success Only
•
Success and Protected Only
•
Success and Failed Only
Change Auditor will now only capture and return the event if the operation mentioned in the event meets the results criteria selected.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating