Chat now with support
Chat with Support

Change Auditor 7.2 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

Change Auditor can generate alerts when certain kinds of configuration changes occur. These alerts appear in the client and are then dispatched to designated recipients via email (SMTP), SNMP or WMI events.

* 
NOTE: You cannot enable alerting for search definitions that use the Runtime Prompt option.
* 
NOTE: SMTP, SNMP and/or WMI must be configured to receive alerts before any alert notifications will be sent.

Smart Alert Technology provides intelligent event correlation by notifying you when event patterns cause potential security risks. You can customize the Smart Alerts to match your security policies. For example, if a privileged account is attempting to log on with a bad password at multiple computers within a predetermined time period, a proactive alert can be generated.

Alert tab (Search Properties tabs)

The Alert tab displays the current alert configuration for the selected search definition. From the Alert tab, you can enable/disable an alert notification for the selected search definition, define how and where to dispatch the alert (via SMTP (email), SNMP and/or WMI), and modify the alert configuration settings.

Use the controls on the Alert tab as described below.

 
Table 1. Alert tab: Field/Control descriptions
Field/Control
Description

Alert Enabled

Select the Alert Enabled check box to enable an alert for the current search definition.

This option will became available only after one of the transport methods are selected in the Send Alert To setting on this tab.

Alert Configuration pane

Send Alert To

Select all of the transport options that are to be applied to this search definition:

•
SNMP - Select this option to dispatch alerts for this search definition via SNMP traps.
•
WMI - Select this option to dispatch alerts for this search definition via WMI (Windows Management Instrumentation) events.
•
SMTP - Select this option to dispatch alerts for this search definition via email. Selecting this option will display the Alert Custom Email dialog allowing you to specify the email address of the persons who are to receive the email notification.

History Search Limit

By default, up to 50,000 events can be included in the alert history. Use the arrow controls to increase or decrease this value to define the maximum number of events to be included in the alert history.

NOTE: The History Search Limit setting is a global setting and changes made to this setting will be applied to ALL alerts.

Configure Email

For SMTP alerts, click Configure Email to change the details about the alert email to be sent, including the To address, the Reply To address, and the Subject Line. In addition, from the Alert Custom Email dialog you can access the Alert Body Configuration dialog to configure the body of the email alert.

NOTE: If SMTP is not configured, a message box appears stating that the Coordinator email configuration has not been configured. Open the Administration Tasks tab and use the Coordinator Configuration page to enable email notification and configure SMTP.

Events Per Email

For SMTP alerts, a maximum of 100 events will be included in a single alert email by default. Use the arrow controls to increase or decrease this value to define the maximum number of events to be included in an email.

Time zone

For SMTP alerts, use this field to specify the time zone to be used for the time stamp in the name of the report attachment. By default, the time zone of the computer where the Change Auditor client resides is used.

Smart Alert pane

Smart Alert Enabled

Select this check box to specify under what conditions an alert is to be sent. This feature is only available for SMTP and SNMP notifications.

Send Alert When <nn> Events Occur Within <nn> <interval>

Select this option to specify the number of events that must occur within a specified time interval before generating/dispatching the alert.

Where: <interval> is one of the following: minutes, hours or days

On A Single Object

Select this check box to specify that the event must occur for the same object the specified number of times before the alert will be triggered. When this check box is cleared (default), the event can occur on any object the specified number of times to trigger the alert.

NOTE: Smart alerts on a single object are only supported for Active Directory and File System subsystems.

Enable alerts

Using the Searches page, you can enable/disable alert notifications for individual search definitions and dispatch them via SMTP (email), SNMP or WMI.

 
* 
NOTE: The right-click commands available for enabling/disabling alert notifications are available when multiple search definitions are selected. However, you can only enable/disable alert notifications using the Alert tab when a single search definition is selected.
To enable SMTP (email) alerts for individual search definitions:
* 
NOTE: To dispatch configuration change alerts through email (SMTP) you must first enable email notification and define the mail server to be used on the Coordinator Configuration page. See Configure email alert notifications/reports in the Coordinator Configuration chapter.
1
Open the Searches page.
2
Expand the Private or Shared folders in the explorer view to locate the search to which an alert is to be associated. Select the search from the Search list in the right-hand pane.
3
Use one of the following methods to enable an alert:
•
Right-click the search and select the Alert | Enable Transport | SMTP command.
•
Open the Alert tab and select the SMTP check box and then the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the search definition and select Show Properties).
* 
NOTE: If SMTP is not configured, a message box will display stating that the coordinator email configuration has not been configured. Open the Administration Tasks tab and use the Coordinator Configuration page to configure SMTP.
4
Using either of these methods displays the Alert Custom Email dialog allowing you to enter the email address of the persons who are to receive the alert notification.
Enter or click the browse button to specify the users who are to receive the alert notification. Selecting the browse button displays one of the following dialogs:
•
The Select Active Directory Objects dialog (directory object picker) where you can use the Browse or Search page to locate Active Directory users. This dialog is displayed when no Exchange host is specified in the SMTP Configuration pane of the Coordinator Configuration page.
•
The Search Users dialog allowing you to locate and select an Exchange user (Exchange tab) or an Active Directory user (Active Directory tab). This dialog is displayed when an Exchange host is defined in the SMTP Configuration pane of the Coordinator Configuration page.
 
* 
NOTE: You can enter an individual email address or distribution list address in the To, Cc or Bcc fields. You can also send the alert notification to additional recipients by selecting the appropriate check box, as described below:
•
Add Who - Select this check box to send an alert to the user who initiated the change that triggered the alert.
•
Add Users - When selected, alerts for user object changes are sent to the user; alerts for mailbox objects are sent to the mailbox owner.
•
Add Managers - When selected, alerts for user object changes are sent to the user manager (if set); alerts for group objects are sent to the managed-by user (if set). Alerts for mailbox objects are sent to the owner's manager (if set).

Once a check box is selected, select the corresponding option to add it to the To, Cc or Bcc field.

By default, the values entered on the SMTP Configuration pane of the Coordinator Configuration page will be used for the following fields/settings:
•
Reply To address
•
Subject line
•
email format (Plain Text or HTML)
•
body of the email alert
If you do not want to use these default settings for the current search query, you can modify them on the Alert Custom Email dialog. To modify the body of the email alert, click Configure Body.
Once you have finished specifying the recipient email addresses, click OK to save your selections and close the dialog.
5
In addition, you can change the following alert configuration settings using the Alert tab (Search Properties tabs):
•
By default, up to 50,000 events will be included in the alert history. Use the History Search Limit setting to change this value. (This setting is a global setting and changes made to this setting will be applied to ALL alerts.)
•
By default, a maximum of 100 events will be included in a single alert email. Use the Events Per Email setting to change this number.
•
By default the time zone of the computer where the Change Auditor client resides is used for an alert’s date/time stamps in the email. To change the time zone to be used for these date/time stamps, select the time zone from the drop-down list.
•
If you want to specify under what conditions an alert is to be sent, select the Smart Alert Enabled check box and specify the number of events that must occur within a specified time interval before generating/dispatching the alert.
By default, a smart alert is generated when the event occurs on any object the specified number of times. You can however, select the On a Single Object option to have the smart alert triggered when the event occurs on the same object the specified number of times.
6
When an alert is enabled, the following indicators are added to the Searches list:
* 
NOTE: If using the Alert tab, be sure to click Save to save the alert definition.
•
Type - the icon for the search (magnifying glass) changes to a check mark and the label changes from ‘Search’ to ‘Alert’ (e.g., Shared Alert)
•
Alert - displays ‘Enabled’
•
Alert To - displays the email address of any users who are to receive the alert email
•
Alert Cc - if specified, displays the email address of any users who are to receive a copy of the alert email
•
Alert Bcc - if specified, displays the email address of any users who are to receive a blind copy of the alert email
To enable SNMP alerts for individual search definitions:
* 
NOTE: In order to generate SNMP alerts, SNMP must be installed and the trap receiver must be started.
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the search to which an alert is to be associated. Select the search from the Search list in the right-hand pane.
3
Use one of the following methods to enable an alert:
•
Right-click the search and select Alert | Enable Transport | SNMP.
•
Open the Alert tab at the bottom of the page, select the SNMP check box, then the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select Show Properties).
4
In addition, you can change the following alert configuration settings using the Alert tab (Search Properties tabs):
•
By default, up to 50,000 events will be included in the alert history. Use the History Search Limit setting to change this value. (This setting is a global setting and changes made to this setting will be applied to ALL alerts.)
•
If you want to specify under what conditions an alert is to be sent, select the Smart Alert Enabled check box and specify the number of events that must occur within a specified time interval before generating/dispatching the alert.
By default, a smart alert is generated when the event occurs on any object the specified number of times. You can however, select the On a Single Object option to have the smart alert triggered when the event occurs on the same object the specified number of times.
5
When an alert is enabled, the following indicators are added to the Searches list:
* 
NOTE: If using the Alert tab, be sure to click Save to save the alert definition.
•
Type - the icon for the search (magnifying glass) changes to a check mark and the label changes from ‘Search’ to ‘Alert’ (e.g., Shared Alert)
•
Alert - displays ‘Enabled’
To enable WMI alerts for individual search definitions:
* 
NOTE: In order to generate WMI alerts, WMI must be installed and started. A WMI event consumer must also be running on the coordinator server.
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the search to which an alert is to be associated. Select the search from the Search list in the right-hand pane.
3
Use one of the following methods to enable an alert:
•
Right-click the search and select the Alert | Enable Transport | WMI command.
•
On the Alert tab, select the WMI check box and then the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select the Show Properties menu command).
4
In addition, you can change the following alert configuration setting using the Alert tab (Search Properties tabs):
•
By default, up to 50,000 events will be included in the alert history. Use the History Search Limit setting to change this value. (This setting is a global setting and changes made to this setting will be applied to ALL alerts.)
5
When an alert is enabled, the following indicators are added to the Searches list:
* 
NOTE: If using the Alert tab, be sure to click Save to save the alert definition.
•
Type - the icon for the search (magnifying glass) changes to a check mark and the label changes from ‘Search’ to ‘Alert’ (e.g., Shared Alert)
•
Alert - displays ‘Enabled’

Disable alerts

To disable alerts:
* 
NOTE: The right-click commands available for enabling/disabling alert notifications are available when multiple search definitions are selected. However, you can only enable/disable alert notifications using the Alert tab when a single search definition is selected.
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the alert-enabled search to be disabled. Select the alert from the Search list box in the right-hand pane.
3
Use one of the following methods to disable an alert:
•
Right-click the alert and select Alert | Disable Alert. A message box is displayed asking you to confirm that you want to disable the alert. Click Yes.
•
Open the Alert tab, clear the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select the Show Properties menu command.)
4
When the alert is disabled, the Alert column displays ‘Disabled’.
* 
NOTE: If using the Alert tab, click the Save button to apply the change.

In addition to disabling an alert, you can also disable the alerting transports for an alert-enabled search.

To disable SMTP alerts for individual search definition:
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the alert-enabled search to be disabled. Select the alert from the Search list in the right-hand pane.
3
Use one of the following methods to disable an alert:
•
Right-click the alert and select Alert | Disable Transport | SMTP. A message box will be displayed asking you to confirm that you want to disable the alert. Click Yes.
•
Open the Alert tab, clear the SMTP check box and the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select the Show Properties menu command.)
If this is the only transport or when all transports are disabled, the definition returns to a ‘Search’ type.
* 
NOTE: If using the Alert tab, click Save to apply the change.
To disable SNMP alerts for individual search definition:
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the alert-enabled search to be disabled. Select the alert from the Search list in the right-hand pane.
3
Use one of the following methods to disable an alert:
•
Right-click the alert and select Alert | Disable Transport | SNMP. A message box will be displayed asking you to confirm that you want to disable the alert. Click Yes.
•
Open the Alert tab, clear the SNMP check box and the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select Show Properties.)
If this is the only transport or when all transports are disabled, the definition returns to a ‘Search’ type.
* 
NOTE: If using the Alert tab, click Save to apply the change.
To disable WMI alerts for individual search definition:
1
Open the Searches page.
2
Expand the Private and Shared folders in the explorer view to locate the alert-enabled search to be disabled. Select the alert from the Search list in the right-hand pane.
3
Use one of the following methods to disable an alert:
•
Right-click the alert and select Alert | Disable Transport | WMI. A message box will be displayed asking you to confirm that you want to disable the alert. Click Yes.
•
Open the Alert tab, clear the WMI check box and the Alert Enabled check box. (If the Search Properties tabs are not being displayed, right-click the alert definition and select the Show Properties menu command.)
 
* 
NOTE: If using the Alert tab, click Save to apply the change.
If this is the only transport or when all transports are disabled, the definition returns to a ‘Search’ type.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating