立即与支持人员聊天
与支持团队交流

Change Auditor 7.4 - Release Notes

IT Security Search requirements

IT Security Search is a web-based interface that correlates IT data from numerous systems and devices into an interactive search engine for fast security incident response and forensic analysis. As a Change Auditor customer, you can use IT Security Search and apply its many features.

Table 19. IT Security Search requirements
Component
Supported Versions

IT Security Search supported up to the following versions

IT Security Search 11.4.1

Auditing and permission requirements

Exchange Server auditing
Table 20. Exchange Server auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for Exchange

Exchange Servers supported up to the following versions
•
Microsoft Exchange Server 2016 CU23

Windows Server 2016

•
Microsoft Exchange Server 2016 CU23

Windows Server 2019, Windows Server Core 2019

•
Microsoft Exchange Server 2019 CU13

For more information

See the Change Auditor for Exchange User Guide.

SQL Server auditing

 
Table 21. SQL Server auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for SQL Server

SQL Servers supported up to the following versions
•
Microsoft SQL Server 2014 SP3
•
Microsoft SQL Server 2016 SP3
•
Microsoft SQL Server 2017
•
Microsoft SQL Server 2019
•
Microsoft SQL Server 2022
NOTE: Change Auditor supports auditing databases that have row and page compression applied.
NOTE: Auditing is supported on SQL clusters only when they are not using high availability technologies.  In this configuration, the agent is not aware of the cluster and only audits the active nodes in the cluster where agents are deployed.
NOTE: Due to a hotfix Microsoft released for SQL Server, Change Auditor agents no longer capture SQL-related events unless the following action is taken on the SQL Server:

Using SQL Server Configuration Manager, add the startup parameter “-T1906” on the Startup Parameters tab in the SQL Server Properties dialog.

This requires a SQL Server service restart.

For more information

See the Change Auditor for SQL Server User Guide.

Exchange Server auditing

Auditing and permission requirements
Exchange Server auditing
Table 20. Exchange Server auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for Exchange

Exchange Servers supported up to the following versions
•
Microsoft Exchange Server 2016 CU23

Windows Server 2016

•
Microsoft Exchange Server 2016 CU23

Windows Server 2019, Windows Server Core 2019

•
Microsoft Exchange Server 2019 CU13

For more information

See the Change Auditor for Exchange User Guide.

SQL Server auditing

 
Table 21. SQL Server auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for SQL Server

SQL Servers supported up to the following versions
•
Microsoft SQL Server 2014 SP3
•
Microsoft SQL Server 2016 SP3
•
Microsoft SQL Server 2017
•
Microsoft SQL Server 2019
•
Microsoft SQL Server 2022
NOTE: Change Auditor supports auditing databases that have row and page compression applied.
NOTE: Auditing is supported on SQL clusters only when they are not using high availability technologies.  In this configuration, the agent is not aware of the cluster and only audits the active nodes in the cluster where agents are deployed.
NOTE: Due to a hotfix Microsoft released for SQL Server, Change Auditor agents no longer capture SQL-related events unless the following action is taken on the SQL Server:

Using SQL Server Configuration Manager, add the startup parameter “-T1906” on the Startup Parameters tab in the SQL Server Properties dialog.

This requires a SQL Server service restart.

For more information

See the Change Auditor for SQL Server User Guide.

SQL Server Data Level auditing

Table 22. SQL Server Data Level auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for SQL Server

SQL Servers supported up to the following versions

NOTE:  
•
Agent memory can increase 1.5 GB per audited database.
•
SQL Data Level auditing templates are assigned to an agent when you create the template. Each audited database requires one template assigned to a single agent.

 
•
Microsoft SQL Server 2014 SP3
•
Microsoft SQL Server 2016 SP3
•
Microsoft SQL Server 2017
•
Microsoft SQL Server 2019
•
Microsoft SQL Server 2022
NOTE:  
•
.Net 4.7.2 is required on the SQL Server where auditing will take place.
•
Auditing is supported on SQL clusters only when they are not using high availability technologies. In this configuration, the agent only audits the active nodes in the cluster where agents are deployed.
•
Auditing is only supported for databases in Full and Bulk logged recovery models. Minimally logged operations performed in bulk logged recovery model may not produce auditing events. An initial backup is required for both Full and Bulk logged databases before the transaction log can properly support auditing.
•
Encrypted databases are not supported.
•
Auditing databases that have row and page compression applied is not supported.

Required permissions

The account specified in the auditing template that is used to access the SQL Server instance must have the following database permissions:

•
Permission to open a connection to the targeted database.
•
Read permissions on targeted tables and system tables.
•
VIEW SERVER STATE permission.
•
SYSADMIN server role.
•
CONTROL SERVER permission.

For more information

See the Change Auditor for SQL Server User Guide.

SQL Server Extended Events auditing (Preview)

 
Table 23. SQL Server Extended Events auditing requirements
Component
Supported Versions

Change Auditor

Change Auditor for SQL Server

SQL Servers supported up to the following versions
•
Microsoft SQL Server 2014 SP3
•
Microsoft SQL Server 2016 SP3
•
Microsoft SQL Server 2017
•
Microsoft SQL Server 2019
•
Microsoft SQL Server 2022
NOTE: Auditing is supported on SQL clusters only when they are not using high availability technologies. In this configuration, the agent only audits the active nodes in the cluster where agents are deployed.
NOTE: Encrypted databases are not supported.
NOTE: Change Auditor does not support auditing databases that have row and page compression applied.

Required permissions

User running Change Auditor client must hold the CA Administrator Role, or a custom role that includes the 'View SQL Templates' operation

The specified SQL login account must have the following SQL Server permissions:

•
Alter any event session
•
View server state
•
Connect SQL
•
View any database

Alternatively, the account must have a SQL server role that contains these permissions, for example 'Sysadmin'.

NOTE:  
•
If using Windows authentication for the SQL Login account, and the specified agent for the auditing template is not installed on the target SQL server, the agent host computer account must also be added to the SQL Security Logins on the target SQL server with the same permissions requirement as the specified SQL login account for the auditing template.
•
If using Windows authentication for the SQL Login account, and the agent for the auditing template is installed on the target SQL server, the local computer ‘NT AUTHORITY\SYSTEM' account must be added to the SQL Security Logins on the target SQL server with the “View Server State” permission granted.

Both SQL and Windows authentication are supported.

For more information

See the Change Auditor for Change Auditor PowerShell Command User Guide or the Change Auditor for SQL User Guide for details.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级