立即与支持人员聊天
与支持团队交流

Change Auditor 7.2 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level Threat Detection

Office 365

Office 365
All Office 365 events in the past 7 days
Who = All Users
What = Office 365 events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)

Exchange Online

All Office 365 Exchange Online events in the past 7 days
Who = All Users
What = Office 365 Exchange Online events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 Exchange Online administrative cmdlets executed this week
Who = All Users
What = Office 365 Exchange Online administration events, external and local
Where = All sources
When = This week
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); User (Grouped)
Office 365 Exchange Online events this week
Who = All Users
What = Office 365 Exchange Online administration, mailbox owner and non-owner events
Where = All sources
When = This week
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 Exchange Online mailbox activity this week
Who = All Users
What = Office 365 Exchange Online Mailbox facility
Where = All sources
When = This week
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); User (Grouped)
Office 365 Exchange Online mailbox auditing configuration changed by an external application in the last 24 hours
Who = N/A
What = Office 365 Exchange Online mailboxes that have had their auditing settings reconfigured in the last 24 hours
Where = All sources
When = Last 24 hours
Origin = N/A
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 Exchange Online mailbox auditing configuration failures in the last 8 hours
Who = N/A
What = Office 365 Exchange mailbox auditing configuration failure
Where = All sources
When = Last 8 hours
Origin = N/A
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 Exchange Online mailbox login activity today
Who = All Users
What = Online mailbox login by owner event
Where = All sources
When = Today
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); User (Grouped)
Office 365 Exchange Online mailbox non-owner activity this week
Who = All Users
What = All non-owner Office 365 Exchange Online Mailbox facility events
Where = All sources
When = This week
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); User (Grouped)

OneDrive for Business

All Office 365 OneDrive for Business events in the past 7 days
Who = All Users
What = Office 365 OneDrive for Business events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Office 365 OneDrive for Business events in the past 7 days grouped by operation
Who = All Users
What = Office 365 OneDrive for Business events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected; Grouped By: Azure - Activity Name/Operation
Office 365 OneDrive for Business file activity events in the past 7 days
Who = All Users
What = Office 365 OneDrive for Business file activity events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 OneDrive for Business folder activity events in the past 7 days
Who = All Users
What = Office 365 OneDrive for Business folder activity events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)

SharePoint Online

All Office 365 SharePoint Online events in the past 7 days
Who = All Users
What = Office 365 SharePoint Online events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Office 365 SharePoint Online events in the past 7 days grouped by operation
Who = All Users
What = Office 365 SharePoint Online events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected; Grouped By: Azure - Activity Name/Operation
Office 365 SharePoint Online file activity events in the past 7 days
Who = All Users
What = Office 365 SharePoint Online file activity events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
Office 365 SharePoint Online folder activity events in the past 7 days
Who = All Users
What = Office 365 SharePoint Online folder activity events
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级