On Demand Audit Current - User Guide

Deleting a search

To remove a search

1. Select the Searches tab.
2. Locate the required search in the list of categories.
3. Highlight the search and click the X icon to delete it.
4. Click Delete to confirm the removal.

Working with categories

When you create a category, you have the option of selecting whether it will be private or shared.

• Private categories are only visible to the individual who created them.
• Shared categories are visible to all On Demand Audit users and allow for collaboration with multiple users from the same organization.

By default, the following categories are available:

• All Private Searches: All private searches belonging to the signed-in user.
• All Searches: All configured searches.
• Active Directory: All Active Directory events in the last 24 hours, 7 days, and 30 days.
• All Events: All events in the last 24 hours and 7 days.
• Azure Active Directory: Azure Active Directory application, directory, group, role, self-service password, user created, user deleted, and user events in the last 7 days.
• Best Practices: Sharing operations on important file types and Teams guest access events.
• Group Policy: Group Policy events.
• Logon Activity: Logon activity events.
• Office 365: Office 365 and SharePoint online events.
• On Demand Audit: All On Demand audit and alert events.
• Teams: Teams user and administrator activity events.
• My searches: A built-in private category.

To create a category

1. Under the Searches tab, click Add in the Categories field.
2. Enter the category name.
3. Select whether the category is private or shared.
4. Click Add.

To assign a search to a new category

1. Under the Searches tab, select the search.
2. Click the pencil icon to modify the search.
3. Drop down the Category field and select the required category.
4. Click Save .

To edit the name of a category

1. Under the Searches tab, select the category.
2. Highlight the category, and click the pencil icon to the left of the category.
3. Enter a new name for the category and click Save.

Working with alerts and alert plans

Alerts and their associated alert plans allow those responsible for the security of your environment to stay on top of changes and activities as they occur.

Through the Alerts page you can:

• View the number of alerts created in the last 24 hours for each search.
• View the number of associated alert plans.
• Enable and disable individual alerts.
• Remove alerts.
• Add and remove associated alert plans.
• Review searches that have alerts created for them.
• Select an information icon to see when shared alerts and alert plans were created, last saved, and by whom.

By clicking on an alert you can:

• View and access all alert plans associated with alert.
• Edit the alert.
• View its associated search.

For details, see Managing alerts and alert plans

Managing alerts and alert plans

Creating an alert for a search allows those responsible for the security of your environment to receive detailed information about vital changes and activities as they occur.

The alert plan allows you to configure who will receive alerts so that they can take the appropriate action to address the outlined risks to your environment.

When you create or modify an alert plan, you have the option of selecting whether it will be private or shared.

• Private alert plans are only visible to the individual who created them.
• Shared alert plans are visible to all On Demand Audit users and allow for collaboration with multiple users from the same organization.

To create an alert with an associated alert plan

1. Under the Searches tab, select the search.
2. Click Alert.
3. Configure the alert plan to associate with the alert.

To create and enable a new alert plan, enter a name for it, and select whether it will be private or shared. Next, select the link to enter the email recipients for the alert, and click Save.

To edit an alert and associated alert plan

1. Under the Alerts tab, select Alerts.
2. Select the required alert, and click Edit Alert.
3. Add and remove the alert plans associate with the alert as required.

To remove an alert

1. Under the Alerts tab, select Alerts.
2. Select the required alert, and click the X icon to delete it.

To create an alert plan

1. Under the Alerts tab, select Alert Plans.
2. Click New Plan.
3. To create and enable a new alert plan, enter a name for it, and select whether it will be private or shared. Next, select the link to enter the email recipients for the alert, and click Save.
4. Click Send Test and OK to verify that a test alert is sent to the appropriate recipients.

To rename an alert plan

1. Under the Alerts tab, select Alert Plans.
2. Select the required alert plan, click in the name field, rename as required, and click Save.

To remove an alert plan

1. Under the Alerts tab, select Alert Plans.
2. Select the required alert, and click the X icon to delete it.