Symantec Security Expressions Server manual View Audit-On-Connect Activity

Models: Security Expressions Server

1 97
Download 97 pages 26.04 Kb
Page 85
Image 85

View Audit-On-Connect Activity

Browse Audit-On-Connect Activity

Audit-On-Connect activity reports show Audit-On-Connect connection events as they were logged over time. Use these reports to troubleshoot and optimize Audit-on-Connect configurations.

SecurityExpressions Audit & Compliance Server dynamically generates reports based on preconfigured or user-defined report profiles. When you first browse Audit-On-Connect activity, a table appears with Audit-On-Connect preconfigured reports and any previously created user- defined reports. SecurityExpressions Audit & Compliance Server provides five Audit-On-Connect preconfigured reports, which are status reports over specific time periods. The top level table shows names such as Status 01 Hour as a preconfigured report. Additional standard reports include Audit-On-Connect Error Log and Audit-On-Connect Exceptions.

Click Show to open the saved report profile. Click Details to drill-down to see details.

Only the policies and scopes to which you have Use access rights appear for selection. Access rights are set in the Windows Group Access options on the Policies page and Scopes page. If you can't find a policy or scope you need to use, ask the item's creator or administrator to add you to one of the Windows User Groups with Use access rights to it.

Furthermore, reports only display audit results involving scopes to which you have View access rights and policies to which you have Result access rights.

Audit-On-Connect Activity Table

Column

Description

 

 

Preconfigured

Yes indicates a standard report. No indicates a custom report

 

profile.

Name

Report Name from the Audit-On-Connect Activity Report

 

Profile

Description

Report description from the Audit-On-Connect Activity Report

 

Profile

Show Most Recent

If you audit the same device multiple times, show the most

 

recent activity report

Detection Methods

Connection Monitor type, which includes DHCP, EventLog, or

 

both

Date From

Date and time activity reporting started

Date To

Date and time activity reporting ended

Adding a New Audit-On-Connect Report Profile

Creating a new report profile creates a filter for a report and defines what appears in each report.

To define a new Audit-On-Connect Report Profile, click New and save the settings and fields to include in the report.

1. Type a Report Name and a short report Description.

77

Page 85
Image 85
Symantec Security Expressions Server manual View Audit-On-Connect Activity, Browse Audit-On-Connect Activity