d174b216-e124-4d51-a43c-373344f897fe Account Usage Account Lockouts Account Logons Accounts which Failed to Logon Failed Logon Count on each Computer Failed Logons Logoff Events Successful Logon Count on each Computer Successful Logons Grouped By Computers Successful Logons Grouped By Users Top Ten Accounts which Failed to Logon Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bdd0f004-5f0d-4681-8a7c-6009a85b1f1e Account Management User Account Management Computer Account Management Password Changes Security Group Management Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 08ed6187-61cd-40c2-b249-6797dd7907d1 Policy Changes Local Audit Policy Changes Domain Policy Changes User Right Assignment Policy Changes System Access Granted/Removed Encrypted Data Recovery Policy IPSEC Policy Changes Kerberos Policy Changes Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5d3525a4-f9e4-4ce0-b41e-c916ab3d5ee8 Object Access Failed Attempts to Access Files and Registry Successful Attempts to Access Files and Registry Object Deleted with Details Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 da5506fc-63d1-4bfe-a897-06202b907165 Application Management Applications Installed/Removed Applications Crashing or Hanging Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4fc372f5-c38d-40bf-b545-99cd5b3cc620 Print Server Print Activities Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9d2cd0a2-17dd-45be-9c8c-554d321899cb Windows Event Log System Event Log Health Audit Log Cleared Event Log Service Errors Service Status Uptime Server Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d91af3d3-e42d-487e-a4a5-96bae008edef Events Trend Generic Event Trend Per Hours Generic Event Trend per Days Generic Event Trend per Weeks Generic Event Trend per Months Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8360c38f-6b13-4d9c-958e-1c1382f4f317 All Critical Messages All Critical Windows Log Events All Critical Syslog Events All Critical W3CELF Events on each Machine All Critical Custom Log Events All Critical SNMP Traps All Critical Microsoft Sql Server Audit Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 Miscellaneous, Customizable Reports Generic Windows Event Log Generic Windows Custom Logs Generic SysLog HTTP Activity Generic W3CELF ISA Log Generic Oracle Audit Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 PCI DSS Compliance PCI DSS Requirement 6 - All Critical Windows Events PCI DSS Requirement 7.1 - User Account Management PCI DSS Requirement 7.1 - Security Group Management PCI DSS Requirement 7.1 - User Right Assignment Policy Changes PCI DSS Requirement 7.1 - System Access Granted/Removed PCI DSS Requirement 7.1 - Successful Attempts to Access Files and Registry PCI DSS Requirement 7.1 - Failed Attempts to Access Files and Registry PCI DSS Requirement 8.5.1 - User Account Management PCI DSS Requirement 8.5.1 - Security Group Management PCI DSS Requirement 8.5.1 - User Right Assignment Policy Changes PCI DSS Requirement 8.5.1 - System access Granted/Removed PCI DSS Requirement 8.5.1 - Password Changes Report PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files PCI DSS Requirement 10.2.2 - All Actions Taken by Any Individual with Root or Administrative Privileges PCI DSS Requirement 10.2.3 - Access to All Audit Trails PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs PCI DSS Requirement 10.2.7 - Creation and Deletion of System-Level Objects PCI DSS Requirement 10.4 - Time Synchronization Monitoring PCI DSS Requirement 10.5.1 - EventsManager Activity Audit - Logons PCI DSS Requirement 10.5.2 - EventsManager Activity Audit PCI DSS Requirement 10.5.5 - Failed Attempts to Access Log Files PCI DSS Requirement 10.5.5 - Successful Attempts to Access Log Files PCI DSS Requirement 10.6 - Generic Event Trend per Hours PCI DSS Requirement 10.6 - Generic Event Trend per Days PCI DSS Requirement 11.4 - Important Network Activity PCI DSS Requirement 11.4 - Network Activity Report Grouped by Destination PCI DSS Requirement 11.4 - Network Activity Report Grouped by Communication Port PCI DSS Requirement 11.4 - All Network Activity Report Grouped by Source PCI DSS Requirement 11.4 - Network Activity Report Grouped by Direction PCI DSS Requirement 11.4 - Account Lockouts Report PCI DSS Requirement 11.4 - Account Logons Report PCI DSS Requirement 11.4 - Failed Logon Count on each Computer PCI DSS Requirement 11.4 - Failed Logons PCI DSS Requirement 11.4 - Logoffs PCI DSS Requirement 11.4 - Successful Logon Count on each Computer PCI DSS Requirement 11.4 - Successful Logons Grouped By Computers PCI DSS Requirement 11.4 - Successful Logons Grouped by Users PCI DSS Requirement 11.4 - Failed Attempts to Access Files and Registry PCI DSS Requirement 11.4 - Successful Attempts to Access Files and Registry PCI DSS Requirement 11.4 - Objects Deleted (All) PCI DSS Requirement 11.5 - Failed Attempts to Access Files and Registry PCI DSS Requirement 11.5 - Successful Attempts to Access Files and Registry PCI DSS Requirement 15.4 - Deleted Files Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 GCSx Code of Connection General and Security Requirements GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing GCSx Code Of Connection Memo 22 SR7 - User Account Management GCSx Code Of Connection Memo 22 SR7 - Password Changes GCSx Code Of Connection Memo 22 SR7 - Security Group Management GCSx Code Of Connection Memo 22 SR7 - User Right Assignment Policy Changes GCSx Code Of Connection Memo 22 SR7 - System Access Granted/Removed GCSx Code Of Connection Memo 22 SR7 - All Actions Taken by any Individual with Root or Administrative Privileges GCSx Code of Connection Memo 22 SR7 - Domain Policy Changes GCSx Code of Connection Memo 22 SR7 - IPSec Policy Changes GCSx Code of Connection Memo 22 SR7 - Kerberos Policy Changes GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months GCSx Code Of Connection Memo 22 SR1 - Time Synchronization Monitoring GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity GCSx Code Of Connection Memo 22 - SR5 - Network Activity Report Grouped by Destination GCSx Code Of Connection Memo 22 - SR6 - Network Activity Report Grouped by Communication Port GCSx Code Of Connection Memo 22 - SR5 - All Network Activity Report Grouped by Source GCSx Code Of Connection Memo 22 - GR25 - Network Activity Report Grouped by Direction GCSx Code Of Connection Memo 22 - Successful Logon Count on each Computer GCSx Code Of Connection Memo 22 - Successful Logons Grouped By Computers GCSx Code Of Connection Memo 22 - Successful Logons Grouped by Users GCSx Code Of Connection Memo 22 - Logoffs GCSx Code Of Connection Memo 22 - Failed Logons GCSx Code Of Connection Memo 22 - Failed Logons Count on each Computer GCSx Code Of Connection Memo 22 - Failed Attempts to Access Files and Registry GCSx Code Of Connection Memo 22 - Successful Attempts to Access Files and Registry GCSx Code Of Connection ISO 27002 10.10 - All Critical Windows Events GCSx Code Of Connection ISO 27002 10.10 - Service Status GCSx Code Of Connection ISO 27002 10.10 - Server Uptime GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend GCSx Code Of Connection ISO 27002 10.10.2 - Generic Windows Event Log GCSx Code Of Connection ISO 27002 10.10.2 - Generic Syslog GCSx Code Of Connection Memo 22 - Deleted Files Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d73c7313-ed40-49ae-b591-3da197e02ad6 SOX Compliance SOX 302.a.4 - User Logon SOX 302.a.4 - User Logoff SOX 302.a.4 - Failure Logons SOX 302.a.4 - All Access to Audit Logs SOX 302.a.4 - Object Access - Failed Attempts to Access Files And Registry SOX 302.a.4 - Object Access - Successful Attempts to Access Files and Registry SOX 302.a.4 - System Startup/Shutdown SOX 302.a.5 - Local Audit Policy Changes SOX 302.a.5 - Domain Policy Changes SOX 302.a.5 - User Rights Assignment Policy Changes SOX 302.a.5 - Password Policy Changes SOX 302.a.6 - Group Management SOX 302.a.6 - Account Management Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 edd4c366-2c84-4a37-9e6b-eebee1ab8efd HIPAA Compliance HIPAA 164.308.a.3 - All Access to Audit Logs HIPAA 164.308.a.4- Object Access - Failed Attempts to Access Files and Registry HIPAA 164.308.a.4- Object Access - Successful Attempts to Access Files and Registry HIPAA 164.308.a.4 - System Startup/Shutdown HIPAA 164.308.a.5 - User Logon HIPAA 164.308.a.5 - User Logoff HIPAA 164.308.a.5 - Failure Logons Container false false 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ce5f479d-ffb2-4346-9c9f-3d93a24ecb8b GLBA Compliance GLBA - User Logon GLBA - User Logoff GLBA - Failure Logons GLBA - All Access to Audit Logs Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce SharePoint SharePoint - Audit Trail Integrity Events SharePoint - Access Control Changes SharePoint - Document Update SharePoint - List Update SharePoint Container - Object Update SharePoint Generic - Object Change Events SharePoint - View Events SharePoint - Audit NOISE SharePoint - Custom Audit SharePoint - Search SharePoint - Import/Export Information Management Policy Changes Container false true 1800-01-01T00:00:00 None false 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b500ea56-cc15-4ca9-ba4a-d0a27e132b2a Successful Logons Grouped By Users The report is based on event 528(4624 - Vista/Longhorn ) - successful logon and event 540(4636 - Vista/Longhorn) - successful network logon. The report shows all successful logons, enabling you to monitor the users successfully accessing the computers using various logon types, and at the same time achieve compliancy with the legal acts which require monitoring of access to the company's resources. The report is grouped by users thus providing a quick view of the computers used by each user. Item false User Name Fully Qualified User Name SpecialColumn true true Computer monitored machine true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:07.9307141+02:00 Daily 1 false false Account Usage\Successful Logons Grouped By Users AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 24799f52-b585-4c50-88db-89b52eb7cfed Successful Logons Grouped By Computers The report is based on event 528(4624 - Vista/Longhorn ) - successful logon and event 540(4636 - Vista/Longhorn) - successful network logon. The report shows all successful logons, enabling you to monitor the users successfully accessing the computers using various logon types, and at the same time achieve compliancy with the legal acts which require monitoring of access to the company's resources. The report is grouped by domains / computers, thus providing a quick view of the logon activity in each domain. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:11.5539213+02:00 Daily 1 false false Account Usage\Successful Logons Grouped By Computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e1ba2484-2bd8-4358-9af8-84728ad650ef Failed Logons The report is based on the events ranging from 529 to 537(4625 - Vista/Longhorn) and event 675 (4771 - Vista/Longhorn). It also lists the reason for the logon failure. In case the logon failure is due to unknown user name or password, investigate multiple logon failures that are below the account lockout threshold. In case the logon failure is due to the fact that the account is disabled, it can signal attempted abuse by former internal users. In case the logon failure is due to the fact that the account is expired, it can signal attempted abuse by contractors or temporary internal users. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None Or false 0 security None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:14.4460867+02:00 Daily 1 false false Account Usage\Failed Logons AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 cd294a62-ba7a-43d3-ab64-dc2fcac99e7f Logoff Events The report is based on the 538(4634 - Vista/Longhorn) event - user logoff. The report shows all logoff events and includes the logon type field. Correlate these events with the successful logon events to determine the duration of each user session. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Logon ID logon id true false Logon Type logon type true false Time time true false Date date true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:17.7922781+02:00 Daily 1 false false Account Usage\Logoff Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f6718ae9-9827-45ed-a21d-877a552b48b8 Account Lockouts The report is based on the 644(4740 - Vista/Longhorn) and 12294 events. The 644 event signals the fact that a user account has locked out because the number of sequential failed logon attempts is greater than the account lockout limit. The 12294 event indicates a possible brute force attack against the default Administrator account. Because this account does not lock out, the system event logs records SAM event 12294 instead. Investigate even a single occurrence of this event immediately, because this can also indicate the presence of an unauthorized operating system. Item false Computer monitored machine true false Target Computer target domain name 0 4740 event id Equal Integer None And false 0 4740 None caller machine name 0 644 event id Equal Integer None And false 0 644 None true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 644 event id Equal Integer None Or false 2 644 None 1 4740 event id Equal Integer None And false 0 4740 None 1 security log name Equal String None Or false 0 security None 0 12294 event id Equal Integer None And false 1 12294 None 0 SAM source Equal String None And false 0 SAM None 1 system log name Equal String None And false 0 system None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:21.9235144+02:00 Daily 1 false false Account Usage\Account Lockouts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4fe7bc84-1283-4417-b45e-004d44c86132 Successful Logon Count on each Computer The report is based on the successful logon events and provides a quick view of the most accessed computers / domain in the network. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Logon count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None Top Bars User Name Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data false None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:24.8136797+02:00 Daily 1 false false Account Usage\Successful Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d8ac9505-3eed-49af-b6d3-2653cf6bea11 Failed Logon Count on each Computer The report is based on the failed logon events and provides a quick view of the login errors occured on each computer. Item false Computer monitored machine true true Description And EventID Description And EventID SpecialColumn true false Logon Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 1 549 event id Equal Integer None And false 0 549 None 0 security log name Equal String None Or false 0 security None Top Bars Description And EventID Description And EventID SpecialColumn true false Event ID event id false false Chart data false None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:27.3328238+02:00 Daily 1 false false Account Usage\Failed Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a1ec0869-607b-4004-b8ac-ac038ff03251 Top 10 Accounts which Failed to Logon The report is based on the failed logon events and provides a quick view of the most frequent login errors occured on each computer. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Logon Attempt Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 1 549 event id Equal Integer None And false 0 549 None 0 security log name Equal String None And false 0 security None Top Pie User Name Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data true None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:30.0359784+02:00 Daily 1 false false Account Usage\Top Ten Accounts which Failed to Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bfa185c1-82f3-47b3-bcd2-264cb0e4cab2 Accounts which Failed to Logon The report is based on the failed logon events occured on each computer. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Logon Attempt Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 1 549 event id Equal Integer None And false 0 549 None 0 security log name Equal String None Or false 0 security None Top Pie User Name Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data false None d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:32.7571341+02:00 Daily 1 false false Account Usage\Accounts which Failed to Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3dd4f1a7-8f1c-42f8-a826-ce2dbf5b5f36 Encrypted Data Recovery Policy The report is based on event 618(4714 - Vista/Longhorn). If encrypted data recovery policy is in use, monitor for this event and investigate any occurrences outside specified policy. Item false User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Date date true false Time time true false Computer monitored machine true true 0 618 event id Equal Integer None Or false 1 618 None 1 4714 event id Equal Integer None And false 0 4714 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:43.8846341+02:00 Daily 1 false false Policy Changes\Encrypted Data Recovery Policy AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c2b26c99-ab1b-4a1a-9764-2de33a7158a5 Object Deleted with Details The report is based on event 564(4660 - Vista/Longhorn) - object deleted. Use this report to view the users deleting objects like files, registry, printers, etc. Failure audits signal failed attempts to delete objects which represent possible attacks to resources. Success audits signal successful delete operations for the audited objects. Verify that the operations are following the company's security policy. Item date false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false object name resource name 0 564 event id Equal Integer None And false 0 564 None object name 0 4660 event id Equal Integer None And false 0 4660 None true false object type resource type 0 564 event id Equal Integer None And false 0 564 None category 0 4660 event id Equal Integer None And false 0 4660 None true false image file name image file name 0 564 event id Equal Integer None And false 0 564 None process name 0 4660 event id Equal Integer None And false 0 4660 None true false object server object server true false date date true false time time true false 0 564 event id Equal Integer None Or false 1 564 None 1 4660 event id Equal Integer None And false 0 4660 None 0 security log name Equal String None And false 0 security None 5d3525a4-f9e4-4ce0-b41e-c916ab3d5ee8 true 2011-12-21T12:16:14.5993909+02:00 Daily 1 false false Object Access\Object Deleted with Details AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d2d8ec72-40d0-4f4d-8de8-25280de84698 Print Activities The report is based on the events 2-14 from the system log, with source "print". It displays all the documents printed, the users printing documents, the file details of the printed files and the date and time when the print operation took place. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Descriptions Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1 event id GreaterThan Integer None And false 0 1 None 0 15 event id LessThan Integer None And false 0 15 None 0 print source Equal String None And false 0 print None 0 system log name Equal String None And false 0 system None 4fc372f5-c38d-40bf-b545-99cd5b3cc620 true 2011-12-21T12:17:02.5721348+02:00 Daily 1 false false Print Server\Print Activities AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e073bd51-74fb-4660-ada4-327716dc1382 Audit Log Cleared The report is based on the 517(1102 - Vista/Longhorn) event which signal the fact that the audit log was cleared. Administrators should not clear security event logs without authorization. Check user performing the attempt field then cross-correlate with authorized personnel. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Caller User Name Caller User Name SpecialColumn true false Date date true false Time time true false 0 517 event id Equal Integer None Or false 1 517 None 1 1102 event id Equal Integer None And false 0 1102 None 0 security log name Equal String None And false 0 security None 9d2cd0a2-17dd-45be-9c8c-554d321899cb true 2011-12-21T12:17:07.7564313+02:00 Daily 1 false false Windows Event Log System\Audit Log Cleared AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f28c208c-23f8-4d75-99d1-f6058cd48712 Uptime Server This report is based on event 6013(Windows OS Version higher than 6.0). It displays the uptime for each server scanned. Item false Computer monitored machine true false Uptime (HH:MM:SS) Uptime SpecialColumn true false Date date true false Time time true false 0 6013 event id Equal Integer None And false 0 6013 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 9d2cd0a2-17dd-45be-9c8c-554d321899cb true 2011-12-21T12:17:10.7526027+02:00 Daily 1 false false Windows Event Log System\Uptime Server AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2b404a1b-c3c1-44ed-b801-4b28e639c45a SOX 302.a.4 - User Logon The report shows logon events generated when a user logs on a computer. The report covers all logon types and includes domain logons irrespective of authentication package being used. Item false Computer monitored machine true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false User Name Fully Qualified User Name SpecialColumn true true 0 672 event id Equal Integer None Or false 1 672 None 0 673 event id Equal Integer None Or false 0 673 None 0 4768 event id Equal Integer None Or false 0 4768 None 0 4769 event id Equal Integer None Or false 0 4769 None 0 674 event id GreaterThan Integer None And false 1 674 None 1 678 event id LessThan Integer None Or false 0 678 None 0 4770 event id GreaterThan Integer None And false 1 4770 None 1 4774 event id LessThan Integer None Or false 0 4774 None 0 679 event id GreaterThan Integer None And false 1 679 None 1 684 event id LessThan Integer None Or false 0 684 None 0 4775 event id GreaterThan Integer None And false 1 4775 None 2 4780 event id LessThan Integer None And false 0 4780 None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:29.8192891+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - User Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 474752d7-8955-4d76-ba49-1fe91c8067ae SOX 302.a.4 - User Logoff This report lists the logoff events on each computer, including the initial logon type. It will help you identify the users successfully ending their sessions. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true true Event ID event id true false Description Description SpecialColumn true false Logon ID logon id true false Logon Type logon type true false Date date true false Time time true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:32.8964651+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - User Logoff AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 cf24dd3e-d561-4f97-812b-83f4ab7d064c SOX 302.a.4 - Failure Logons This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:35.7556287+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - Failure Logons AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fca43d23-70b2-450c-94e1-dc0f9ead4267 SOX 302.a.4 - Object Access - Failed Attempts to Access Files and Registry The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unauthorized users or unauthorized applications attempting to access files and registry that are security sensitive and may indicate a breach or a tampering attempt. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2011-12-20T11:47:09.9786546+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - Object Access - Failed Attempts to Access Files And Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 59831f9b-cd1f-46ce-affd-21edf22ba407 SOX 302.a.4 - Object Access - Successful Attempts to Access Files and Registry The report will list all the successful attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting successfuly accessing files and registry that are security sensitive. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:41.2349421+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - Object Access - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4cd48710-64c3-4618-b104-a46291b73f25 SOX 302.a.4 - System Startup/Shutdown This report will display system startup and shutdown events. Item false Event ID event id true false Description Event Description SpecialColumn true false Date date true false Time time true false Computer monitored machine true true 0 6006 event id Equal Integer None Or false 1 6006 None 1 6009 event id Equal Integer None And false 0 6009 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:43.8360909+02:00 Daily 1 false false SOX Compliance\SOX 302.a.4 - System Startup/Shutdown AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9398e4a3-de1a-4c09-8e16-8e1ca9bd473c SOX 302.a.5 - Local Audit Policy Changes The report shows the changes to the local audit policy of the computers being monitored by EventsManager. Item false Computer name monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy Change privilege use 0 612 event id Equal Integer None And false 0 612 None category id 0 4719 event id Equal Integer None And false 0 4719 None true false Date date true false Time time true false 0 612 event id Equal Integer None Or false 1 612 None 1 4719 event id Equal Integer None And false 0 4719 None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:46.740257+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Local Audit Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4d19111f-9eac-4df9-aa7a-f8799d9141ff SOX 302.a.5 - User Rights Assignment Policy Changes The report is based on the 608(4704 - Vista/Longhorn) and 609(4705 - Vista/Longhorn) events. The event signals the fact that a new privilege was granted / removed to /for a user account. The event log records this action along with the user account Security Identifier (SID), not the user account name. In order to display the information in a more understandable manner, the privileges granted were translated to the associated policy name which was changed. For example, instead of SeTcbPrivilege, the report lists "Act as part of the operating system". Item false Computer monitored machine true true Account Modified assigned to 0 608 event id Equal Integer None And false 0 608 None removed from 0 609 event id Equal Integer None And false 0 609 None target SID 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None And false 0 4705 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privileges user right 0 608 event id Equal Integer None Or false 0 608 None 0 609 event id Equal Integer None Or false 0 609 None privilege list 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None Or false 0 4705 None true false Date date true false Time time true false 0 608 event id Equal Integer None Or false 1 608 None 0 609 event id Equal Integer None Or false 0 609 None 0 4704 event id Equal Integer None Or false 0 4704 None 1 4705 event id Equal Integer None And false 0 4705 None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:50:49.0273878+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - User Rights Assignment Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 16b0f9c6-b210-4fe4-bd45-324eb829c1b6 SharePoint - Audit Trail Integrity Events This report lists all events (11, 12, and 20) with potential impact to audit trail integrity including any changes to the audit policy that defines which types of security events are logged as well as deletion of log records. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Description Share Point Object SpecialColumn true false 0 11 event id Equal Integer None Or false 1 11 None 0 12 event id Equal Integer None Or false 0 12 None 1 20 event id Equal Integer None And false 0 20 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None Or false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:00:59.6827315+02:00 Daily 1 false false SharePoint\SharePoint - Audit Trail Integrity Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2964ebea-6b8f-4086-968c-69cbdfa3e5e1 SharePoint - List Update This report lists SharePoint audit events concerning updates to Lists (event ID 44) and List Items (event ID 45) and List Item deleted (event ID 19). LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Object Share Point Object SpecialColumn true false 0 19 event id Equal Integer None Or false 1 19 None 0 44 event id Equal Integer None Or false 0 44 None 1 45 event id Equal Integer None And false 0 45 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:02.1968753+02:00 Daily 1 false false SharePoint\SharePoint - List Update AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ef6449d8-1c8e-4d07-a16f-c3aba6d5e91d SharePoint Container - Object Update This report lists SharePoint audit events concerning updates to site collections, webs, document libraries and folders: 40 - Site collection updated, 41 - Web updated, 42 - Document library updated and 46 - Folder updated. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Object Share Point Object SpecialColumn true false 0 40 event id Equal Integer None Or false 1 40 None 0 41 event id Equal Integer None Or false 0 41 None 0 42 event id Equal Integer None Or false 0 42 None 1 46 event id Equal Integer None And false 0 46 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:04.6600162+02:00 Daily 1 false false SharePoint\SharePoint Container - Object Update AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 82c59ce7-387c-4c18-8aa8-4d1651173b5e SharePoint Generic - Object Change Events This report lists SharePoint audit events for certain change operations dealing with various object types: 15 - Child object deleted, 16 - Child object moved, 17 - Object copied, 19 - Object deleted, 21 - Object moved, 22 - Object profile changed, 23 - SharePoint object structure changed, 39 - Object restored, 45 - List item updated and 51 - Workflow accessed. These event IDs are not object type specific. To limit the report to specific operations, filter on event ID or to research a specific object, filter the description on portions of the object title, description or URL. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Object Share Point Object SpecialColumn true false 0 15 event id Equal Integer None Or false 1 15 None 0 16 event id Equal Integer None Or false 0 16 None 0 17 event id Equal Integer None Or false 0 17 None 0 19 event id Equal Integer None Or false 0 19 None 0 21 event id Equal Integer None Or false 0 21 None 0 22 event id Equal Integer None Or false 0 22 None 0 23 event id Equal Integer None Or false 0 23 None 0 39 event id Equal Integer None Or false 0 39 None 1 51 event id Equal Integer None And false 0 51 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:06.946147+02:00 Daily 1 false false SharePoint\SharePoint Generic - Object Change Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2e65deca-886a-4cbe-a813-1068934397d8 SharePoint - Search This report provides an audit trail of search queries (event ID 24) executed by users. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Event ID event id true false Search field 03 true false 0 24 event id Equal Integer None And false 1 24 None 0 LOGbndSP source Equal String None And false 0 LOGbndSP None 1 custom logs log name Equal String None Or false 0 custom logs None 0 24 event id Equal Integer None And false 1 24 None 0 LOGbndSC source Equal String None And false 0 LOGbndSC None 1 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:09.2632795+02:00 Daily 1 false false SharePoint\SharePoint - Search AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4260174c-1361-4d40-98be-12937cbcf5ad SharePoint - Import/Export This report lists export and import events (56-59) of SharePoint objects. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false Object Share Point Object SpecialColumn true false 0 56 event id Equal Integer None Or false 1 56 None 1 59 event id Equal Integer None And false 0 59 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:11.596413+02:00 Daily 1 false false SharePoint\SharePoint - Import/Export AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 84b437b4-2ba2-409c-b2cd-7026b805b872 Information Management Policy Changes This report lists changes (event IDs 52-55) to Information Management Policy. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Policy Details Share Point Operation SpecialColumn true false Object Share Point Object SpecialColumn true false 0 51 event id GreaterThan Integer None And false 1 51 None 1 56 event id LessThan Integer None And false 0 56 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:14.2395641+02:00 Daily 1 false false SharePoint\Information Management Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9e2ad73f-2b5c-4c3f-b970-7c02c9aa13c5 PCI DSS Requirement 7.1 - User Right Assignment Policy Changes User Right Assignment Policy Changes Report for PCI DSS requirement 7.1 - The report will list any change in the user rights assignment policy, with information on who assigned the right, what right was it and to whom was the right assigned. The report helps you determine who has been given access to computers or resources throughout the entire domain. Item false Computer name monitored machine true true Account Modified assigned to 0 608 event id Equal Integer None And false 0 608 None removed from 0 609 event id Equal Integer None And false 0 609 None target SID 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None And false 0 4705 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privileges user right 0 608 event id Equal Integer None Or false 0 608 None 0 609 event id Equal Integer None Or false 0 609 None privilege list 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None Or false 0 4705 None true false Date date true false Time time true false 0 608 event id Equal Integer None Or false 1 608 None 0 609 event id Equal Integer None Or false 0 609 None 0 4704 event id Equal Integer None Or false 0 4704 None 1 4705 event id Equal Integer None And false 0 4705 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:38.8452548+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Right Assignment Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c99964da-0738-4f52-9aab-9e16d43180e2 PCI DSS Requirement 7.1 - Successful Attempts to Access Files and Registry Successful Attempts to Access Files and Registry Report for PCI DSS requirement 7.1 The report will list all the successful attempts to access files and registry based on the object access events. The report will help you determine if there are unauthorized users who managed to acces files that may contain cardholder information. Simply cross reference the users listed in this report with the list of authorized users. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 Success Audit type Equal Integer None And false 0 8 None 0 security log name Equal String None And false 0 security None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:42.2924519+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 72ff06aa-78cf-4092-96c3-8b3123a1842a PCI DSS Requirement 7.1 - Failed Attempts to Access Files and Registry Failed Attempts to Access Files and Registry Report for PCI DSS requirement 7.1 The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unauthorized users attempting to access files that may contain cardholder information. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 Failure Audit type Equal Integer None And false 0 16 None 0 security log name Equal String None And false 0 security None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:45.3326258+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Failed Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 805f8f59-b22b-4510-be9b-4ed3b81d2c20 PCI DSS Requirement 8.5.1 - User Right Assignment Policy Changes User Right Assignment Policy Changes Report for PCI DSS requirement 8.5.1 - The report will list any change in the user rights assignment policy, with information on who assigned the right, what right was it and to whom was the right assigned. The report helps you determine who has been given access to computers or resources throughout the entire domain. Additionally, the data in this report can help you undo the operations that were unauthorized. Item false Computer name monitored machine true true Account Modified assigned to 0 608 event id Equal Integer None And false 0 608 None removed from 0 609 event id Equal Integer None And false 0 609 None target SID 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None And false 0 4705 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privileges user right 0 608 event id Equal Integer None Or false 0 608 None 0 609 event id Equal Integer None Or false 0 609 None privilege list 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None Or false 0 4705 None true false Date date true false Time time true false 0 608 event id Equal Integer None Or false 1 608 None 0 609 event id Equal Integer None Or false 0 609 None 0 4704 event id Equal Integer None Or false 0 4704 None 1 4705 event id Equal Integer None And false 0 4705 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:48.1967896+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Right Assignment Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2c8115d0-a245-4be1-8591-c8fe84b58373 PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files All Individual Access to Cardholder Data Stored in Files Report for PCI DSS requirement 10.2.1 - The report shows file related activity based on object access events that trigger the corresponding rule in the "Events Processing Rules" section, the "PCI Requirements for Windows OS" group. The report helps you identify what files are being accessed and by whom. In order to populate this report more accurately, the corresponding processing rules need to be configured to trigger for specific locations (folders) that contain cardholder data. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 file object type Equal String None And false 0 file None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:51.2689654+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1bcf18b5-429d-4d93-b98a-a1d55c97a19d PCI DSS Requirement 10.5.1 - EventsManager Activity Audit - Logons EventsManager Activity Audit - Logons Report for PCI DSS requirement 10.5.1 - The report shows the logons to the main console of EventsManager. Item false User Fully Qualified User Name SpecialColumn true false Message message true false Date date true false Time time true false 0 login message Contains String None Or false 1 login None 1 logout message Contains String None And false 0 logout None 0 security log name Equal String None And false 0 security None 0 Windows log format Equal String None And false 0 windows None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:54.0131223+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 10.5.2 - EventsManager Activity Audit AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3d826b52-2d7b-4275-8efb-206068749ee9 PCI DSS Requirement 10.5.2 - EventsManager Activity Audit EventsManager Activity Audit Report for PCI DSS requirement 10.5.2 - The report shows the activity that the users have performed on the main console of EventsManager. This activity may include: logons to the console, logoffs, EventsManager configuration changes and access to the log browsers. Item false User Fully Qualified User Name SpecialColumn true false Message group type changed true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 Windows log format Equal String None And false 0 windows None 0 Success Audit type Equal Integer None Or false 1 8 None 1 Failure Audit type Equal Integer None And false 0 16 None 0 audit event class Contains String None And false 0 audit None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:56.7552792+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.5.2 - EventsManager Activity Audit AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 237d8dac-b001-435f-be7a-1979efbf6b8c PCI DSS Requirement 10.6 - Generic Event Trend per Hours Generic Event Trend per Hours Report for PCI DSS requirement 10.6 - The report is used to display statistical information about the trend of the collected events. It shows a section with the top 10 computers with the most events. The events trend chart is being divided per hours and the trend of events for each computer is also shown individually. The report can be used to determine time intervals where an unusually high number of events were generated. Item false Computer monitored machine true true Date/Time DistinctHour SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns server log name Equal String None Or false 0 dns server None 0 directory services log name Equal String None Or false 0 directory services None 0 file replication service log name Equal String None Or false 0 file replication service None Top Line Date/Time DistinctHour SpecialColumn true false Event ID event id false false Chart data false None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:31:59.1954187+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.6 - Generic Event Trend per Hours AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 da9218d3-5abc-467f-afb1-ff33dfc320f1 PCI DSS Requirement 10.6 - Generic Event Trend per Days Generic Event Trend per Days Report for PCI DSS requirement 10.6 - The report is used to display statistical information about the trend of the collected events. It shows a section with the top 10 computers with the most events. The events trend chart is being divided per days and the trend of events for each computer is also shown individually. The report can be used to determine time intervals where an unusually high number of events were generated. Item false Computer monitored machine true true Date/Time date true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns server log name Equal String None Or false 0 dns server None 0 directory services log name Equal String None Or false 0 directory services None 0 file replication service log name Equal String None Or false 0 file replication service None Top Line Date/Time date true false Event ID event id false false Chart data false None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:02.0095797+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.6 - Generic Event Trend per Days AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9ec57eec-7b1b-468a-80cd-d6883e8d63ec PCI DSS Requirement 11.4 - Important Network Activity Network Activity Report for PCI DSS requirement 11.4 - This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Application Name application name true false Dest. Addr. destination address true false Dest. Port destination port true false Source Addr. source address true false Source Port source port true false Direction direction true false Protocol protocol true false Time time true false Date date true false importance importance true true 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 0 Critical importance Equal Integer None Or false 1 4 None 1 High importance Equal Integer None And false 0 3 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:08.5759553+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 11.4 - All Network Activity Report Grouped by Source AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 cc939a97-4bbb-4162-aeff-e51625fde501 PCI DSS Requirement 11.4 - Network Activity Report Grouped by Communication Port Network Activity Report for PCI DSS requirement 11.4 - This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Application Name application name true false Destination Address destination address true false Destination Port destination port true true Source Address source address true false Source Port source port true false Direction direction true false Protocol protocol true false Time time true false Date date true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:13.6442452+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 11.4 - All Network Activity Report Grouped by Source AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 220e75f3-2eae-41c4-82a6-453c1609f55d PCI DSS Requirement 11.4 - Network Activity Report Grouped by Direction The report shows the entire network activity grouped by direction, based on the Windows Filtering Platform events that are collected from Windows Vista and later operating systems. Item false Application Name application name true false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Destination Address destination address true false Destination Port destination port true false Source Address source address true false Source Port source port true false Direction direction true true Protocol protocol true false Time time true false Date date true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:16.0603834+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Network Activity Report Grouped by Direction AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 37e2959c-2223-4110-9a95-4e023139cd3c PCI DSS Requirement 11.4 - Account Lockouts Report Account Lockouts Report for PCI DSS requirement 11.4 - This report lists all "account locked out" events, including those which can indicate a brute force attack. Item false Computer monitored machine true false User User Identification SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 644 event id Equal Integer None Or false 2 644 None 1 4740 event id Equal Integer None And false 0 4740 None 1 security log name Equal String None Or false 0 security None 0 12294 event id Equal Integer None And false 1 12294 None 0 SAM source Equal String None And false 0 SAM None 1 system log name Equal String None And false 0 system None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:18.5655266+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Lockouts Report AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 579fb3bf-fa37-4ea4-8bd3-960a86078882 PCI DSS Requirement 11.4 - Failed Logon Count on each Computer Failed Logon Count on each Computer Report for PCI DSS requirement 11.4 - This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify the computers that show suspect access attempts. Item false Computer monitored machine true true Description Description SpecialColumn true false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 1 549 event id Equal Integer None And false 0 549 None 0 security log name Equal String None And false 0 security None Top Bars Description Description SpecialColumn true false Event ID event id false false Chart data false None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:21.211678+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Failed Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 42e5feba-7203-4814-9607-b9d52d2da90c PCI DSS Requirement 11.4 - Successful Logon Count on each Computer Successful Logon Count on each Computer Report for PCI DSS requirement 11.4 - This report shows logons by computer and allows you to quickly view the most accessed computers. Item false Computer monitored machine true true User Fully Qualified User Name SpecialColumn true false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None Top Bars User Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data false None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:23.5238102+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Successful Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3885056a-e8ba-4f37-9ff9-24a3aa981162 PCI DSS Requirement 11.4 - Successful Logons Grouped By Computers Successful Logons Grouped By Computers Report for PCI DSS requirement 11.4 - This report lists all successful logons grouped by computers helping you identify the users who log on certain machines. Item false Computer monitored machine true true User Fully Qualified User Name SpecialColumn true false Event ID event id true false Description rule name true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None Or false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:26.3009691+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Successful Logons Grouped By Computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4adfd869-263f-463d-8326-4c3c5dc691de PCI DSS Requirement 11.4 - Successful Logons Grouped by Users Successful Logons Grouped By Users Report for PCI DSS requirement 11.4 - This report lists all successful logons grouped by users, helping you determine the computers a certain user has logged on to. Item false User Fully Qualified User Name SpecialColumn true true Computer monitored machine true false Event ID event id true false Description rule name true false Account Account SpecialColumn true false Logon Type logon type true false Time time true false Date date true false 0 528 event id Equal Integer None Or false 1 528 None 0 4624 event id Equal Integer None Or false 0 4624 None 0 540 event id Equal Integer None Or false 0 540 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:28.8051123+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Successful Logons Grouped by Users AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d9f074a9-1766-455e-9a09-a335b063978f PCI DSS Requirement 11.4 - Failed Attempts to Access Files and Registry Failed Attempts to Access Files and Registry Report for PCI DSS requirement 11.4 - The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unauthorized users or unauthorized applications attempting to access files and registry that are security sensitive and may indicate a breach or a tampering attempt. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 file object type Equal String None Or false 1 file None 1 key object type Equal String None And false 0 key None 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:34.045412+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Failed Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7324695d-01d1-46a5-b8d0-a23b86d3771c PCI DSS Requirement 11.4 - Successful Attempts to Access Files and Registry Successful Attempts to Access Files and Registry Report for PCI DSS requirement 11.4 - The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting successfuly accessing files and registry that are security sensitive. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 Success Audit type Equal Integer None And false 0 8 None 0 security log name Equal String None And false 0 security None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:36.9245767+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 64b786b2-ca67-4b77-9d97-9d15c68b6125 PCI DSS Requirement 11.4 - Objects Deleted (All) Deleted Objects (All) Report for PCI DSS requirement 11.4 - The report lists all the deleted objects and can help you identify attemtps to remove traces of unauthorized activity. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Image File Name image file name true false Object Server object server true false Time time true false Date date true false 0 560 event id Equal Integer None Or false 2 560 None 1 4656 event id Equal Integer None And false 0 4656 None 1 delete accesses Contains String None And false 0 delete None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:40.1177594+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Objects Deleted (All) AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 814f844f-d38b-4752-812b-a359e973ec47 PCI DSS Requirement 11.5 - Failed Attempts to Access Files and Registry Failed Attempts to Access Files and Registry Report for PCI DSS requirement 11.5 - The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unauthorized users or unauthorized applications attempting to access files and registry that are important for the main system functionality. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 File object type Equal String None Or false 1 File None 1 Key object type Equal String None And false 0 Key None 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:42.7089076+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.5 - Failed Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 df3edce9-34d7-4a4a-bd42-57cdbe13fd0d PCI DSS Requirement 11.5 - Successful Attempts to Access Files and Registry Successful Attempts to Access Files and Registry Report for PCI DSS requirement 11.5 - The report will list all the successful attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting to access files and registry that are important for the main system functionality. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 File object type Equal String None Or false 1 File None 1 Key object type Equal String None And false 0 Key None 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:45.3700598+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.5 - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 437426d0-c95d-4abb-8bae-556d2f1d5992 PCI DSS Requirement 11.4 - Logoffs Logoffs Report for PCI DSS requirement 11.4 - This report lists the logoff events on each computer, including the initial logon type. It will help you identify the users successfully ending their sessions. Item false Computer monitored machine true false User username true false Event ID event id true false Description description id true false Logon ID logon id true false Logon Type logon type true false Date date true false Time time true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:47.8692027+02:00 Daily 1 false false PCI DSS Compliance\Copy of SOX 302.a.4 - User Logoff AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d9853ed4-c228-4e4f-9e24-c13eccf478c6 PCI DSS Requirement 11.4 - Failed Logons Failed Logons Report for PCI DSS requirement 11.4 - This report lists the failed logons on each computer in detail, as well as the type of failure, helping you identify the computers that show suspect access attempts, who are the users failing to logon and for what reason. Item false Computer monitored machine true false Username username true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None Or false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:50.357345+02:00 Daily 1 false false PCI DSS Compliance\Copy of SOX 302.a.4 - Failure Logons AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 331b532d-21cd-4c18-9412-4e945477ebe0 PCI DSS Requirement 11.4 - Account Logons Account Logons Report for PCI DSS requirement 11.4 - This report shows all successful logons grouped by users, allowing you to quickly see which computers a user has logged on to. The emerging list can be compared with the current authorization list in order to identify authorization breaches. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 051e85b5-45fd-4228-b4f5-d06cc83c6b7c NTLM Logon attempts The group is based on event 680(4776 - Vista/Longhorn) - Account used for logon and 681(4777 - Vista/Longhorn) - Logon to account failed. The evens identify the account used for the successful or failed domain logon attempts. Event 680 is logged on Windows 2003 domains both for successful and failed attempts. On Windows 2000 domains, event 680 is logged only for successful attempts while event 681 is logged for failed attempts. Item false Computer monitored machine true false Type type 0 4776 event id LessThan Integer None Or false 0 4776 None 0 4776 event id GreaterThan Integer None Or false 0 4776 None Success FixedValue 0 4776 event id Equal Integer None And false 0 4776 None true false Description Description SpecialColumn true false Logon Account Account SpecialColumn 0 680 event id Equal Integer None Or false 0 680 None 0 681 event id Equal Integer None And false 0 681 None target user name 0 4776 event id Equal Integer None And false 0 4776 None true false Source Workstation from workstation 0 681 event id Equal Integer None And false 0 681 None workstation 0 4776 event id Equal Integer None And false 0 4776 None source workstation 0 680 event id Equal Integer None And false 0 680 None true false Error Code the error code was 0 681 event id Equal Integer None And false 0 681 None error code 0 680 event id Equal Integer None And false 0 680 None true false Time time true false Date date true false event id event id true false 0 680 event id Equal Integer None Or false 1 680 None 0 681 event id Equal Integer None Or false 0 681 None 0 4776 event id Equal Integer None Or false 0 4776 None 1 4777 event id Equal Integer None And false 0 4777 None 0 security log name Equal String None Or false 0 security None 331b532d-21cd-4c18-9412-4e945477ebe0 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons\NTLM Logon attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4d122a80-6c58-457e-bdd1-809e7ae5bdf3 Kerberos authentication ticket requests The section is based on event 672(4768-Vista/Longhorn) - authentication ticket request. This event enables the tracking of initial domain logons through the granting of ticket-granting tickets (TGT).Windows 2003 domain records this event for both success and failure requests. The type field indicates whether the request was successful or not. In Windows 2000 domains, the event only records successful requests. For failed requests in Windows 2000 domains use the 676 event. Item false Computer monitored machine true false Type type 0 4768 event id LessThan Integer None Or false 0 4768 None 0 4768 event id GreaterThan Integer None Or false 0 4768 None Success FixedValue 0 4768 event id Equal Integer None And false 0 4768 None true false User Name Fully Qualified User Name SpecialColumn true false Service Name service name true false Client Address client address 0 4768 event id LessThan Integer None Or false 0 4768 None 0 4768 event id GreaterThan Integer None Or false 0 4768 None ip address 0 4768 event id Equal Integer None And false 0 4768 None true false Result Code result code true false Time time true false Date date true false 0 672 event id Equal Integer None Or false 1 672 None 0 676 event id Equal Integer None Or false 0 676 None 1 4768 event id Equal Integer None And false 0 4768 None 0 security log name Equal String None Or false 0 security None 331b532d-21cd-4c18-9412-4e945477ebe0 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons\Kerberos service ticket requests AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6f6336cc-07df-499e-b156-1efda56d6964 Kerberos service ticket requests The section is based on event 673(4769-Vista/Longhorn) - A ticket granting service (TGS) ticket was requested. After a user's workstation requests a ticket-granting ticket (TGT), the workstation immediately requests a service ticket (TGS) so that the user can use the workstation. Windows 2003 domain records this event for both success and failure requests. The type field indicates whether the request was successful or not. In Windows 2000 domains, the event only records successful requests. For failed requests in Windows 2000 domains use the 677 event. Item false Computer monitored machine true false Type type true false User Name Fully Qualified User Name SpecialColumn true false Service Name service name true false Client Address client address true false Failure Code failure code true false Time time true false Date date true false 0 673 event id Equal Integer None Or false 1 673 None 0 4769 event id Equal Integer None Or false 0 4769 None 0 676 event id Equal Integer None Or false 0 676 None 1 677 event id Equal Integer None And false 0 677 None 0 security log name Equal String None And false 0 security None 331b532d-21cd-4c18-9412-4e945477ebe0 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons\Kerberos service ticket requests AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 af8e243e-1c89-4283-ad38-a946bb7a7f20 Terminal services account logon events The section is based on events 682(4778 - Vista/Longhorn) and 683(4779 - Vista/Longhorn) from the Account Logon category. The 682 event is recorded when a user has reconnected to a disconnected Terminal Services session. The 683 event is recorded when a user disconnected a Terminal Services session without logging off. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Session Name session name true false Client Name client name true false Client Address client address true false Time time true false Date date true false 0 682 event id Equal Integer None Or false 1 682 None 0 683 event id Equal Integer None Or false 0 683 None 0 4778 event id Equal Integer None Or false 0 4778 None 1 4779 event id Equal Integer None And false 0 4779 None 0 security log name Equal String None Or false 0 security None 331b532d-21cd-4c18-9412-4e945477ebe0 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons\Copy of NTLM Logon attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bdd5ba02-afae-441d-99fa-895fd8b1e1c9 PCI DSS Requirement 11.4 - All Network Activity Report Grouped by Source The report shows the entire network activity grouped by direction, based on the Windows Filtering Platform events that are collected from Windows Vista and later operating systems. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Application Name application name true false Destination Address destination address true false Destination Port destination port true false Source Address source address true true Source Port source port true false Direction direction true false Protocol protocol true false Time time true false Date date true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:33:16.2488259+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 11.4 - Network Activity Report Grouped by Direction AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ac7d9ff9-5d8c-448e-89c8-dfbad254054b PCI DSS Requirement 10.5.5 - Successful Attempts to Access Log Files Successful Attempts to Access Log Files for PCI DSS requirement 10.5.5 - The report will list all the successful attempts to access files with the .evt and .evtx extension. It will help you identify unathorized users attempting to access Windows log files physically, without using the EventLog methods that are being restrictive and logged. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 File object type Equal String None And false 0 File None 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 0 .evtx object name Contains String None Or false 1 .evtx None 1 .evt object name Contains String None Or false 0 .evt None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:33:20.5970746+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 11.5 - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b8cf7274-394d-4ce0-b7c0-084c25fd6c54 PCI DSS Requirement 10.5.5 - Failed Attempts to Access Log Files Failed Attempts to Access Log Files for PCI DSS requirement 10.5.5 - The report will list all the failed attempts to access files with the .evt and .evtx extension. It will help you identify unathorized users attempting to access Windows log files physically, without using the EventLog methods that are being restrictive and logged. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Time time true false Date date true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 0 .evtx object name Contains String None Or false 1 .evtx None 1 .evt object name Contains String None And false 0 .evt None 0 file object type Equal String None Or false 0 file None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:33:23.5632443+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 10.5.5 - Successful Attempts to Access Log Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 26571e25-7f3a-427e-be6f-284e7d0cae4a PCI DSS Requirement 6 - All Critical Windows Events The report shows all critical Windows events providing information on system errors or security violations. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:33:33.0107847+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 6 - All Critical Windows Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bef8e049-1ccd-43d8-8ef6-da7a1b619087 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 26571e25-7f3a-427e-be6f-284e7d0cae4a true 2011-12-21T12:33:33.0107847+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 6 - All Critical Windows Events\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c3dc966f-3a95-4d82-8213-d04cbce794a4 All Critical Windows Events A table showing all the events that correspond to the current filtering conditions. Item false Computer scanned computer true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Rule Name rule name true false Time time true false Date date true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None 26571e25-7f3a-427e-be6f-284e7d0cae4a true 2011-12-21T12:33:33.0107847+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 6 - All Critical Windows Events\Copy of All Critical Windows Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 91b461df-2536-413a-a099-51f6e5e16865 PCI DSS Requirement 7.1 - User Account Management User Account Management Report for PCI DSS requirement 7.1 - The report will help you achieve the following goals: Find irregular or unusual network account activities, identify administrators who abuse privileges to create or modify accounts and detect patterns of account activities that breach organizational security policies. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f9f97aaa-0cc5-465d-a821-38dd558e6b70 User Account Created The section is based on event 624(4720 - Vista/Longhorn). Only authorized people and processes should create network accounts. Examine the user performing the attempt field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. Item false User Creating The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Logon ID caller logon id true false New Account Name new account name 0 624 event id Equal Integer None And false 0 624 None target user name 0 4720 event id Equal Integer None And false 0 4720 None true false Date date true false Time time true false 0 624 event id Equal Integer None Or false 2 624 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6b335511-4f3f-4c94-aac2-7b490d07f33c User Account Enabled The section is based on event 626(4722 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person enabling the accounts is authorized. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 626 event id Equal Integer None And false 0 626 None target user name 0 4722 event id Equal Integer None And false 0 4722 None true false Target Domain target domain 0 626 event id Equal Integer None And false 0 626 None target domain name 0 4722 event id Equal Integer None And false 0 4722 None true false Date date true false Time time true false 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Enabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 755608aa-734c-43e5-8762-7fa1e69351e2 User Account Disabled The section is based on event 629(4725 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person disabling the accounts is authorized and that he or she verified the reasons why the accounts were disabled prior to enabling the accounts. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 629 event id Equal Integer None And false 0 629 None target user name 0 4725 event id Equal Integer None And false 0 4725 None true false Taget Domain target domain 0 629 event id Equal Integer None And false 0 629 None target domain name 0 4725 event id Equal Integer None And false 0 4725 None true false Date date true false Time time true false 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Disabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b5c3245b-5c17-4be1-a234-e0395456f45d User Account Deleted The section is based on event 630(4726 - Vista/Longhorn). Only authorized people and processes should delete network accounts. Search for these events and examine the user performing the attempt field to detect if unauthorized people have deleted accounts. Item false User Deleting The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4729 event id Equal Integer None And false 0 4729 None true false Date date true false Time time true false 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 97803dfe-d33b-4802-a296-21d6bcc7478b User Account Unlocked The section is based on event 671(4767 - Vista/Longhorn) and lists all the accounts which were unlocked. Verify that the person unlocking the accounts is authorized and that he or she verified the reasons for the account lockouts prior to unlocking the accounts. Item false User Unlocking The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 671 event id Equal Integer None And false 0 671 None target user name 0 4767 event id Equal Integer None And false 0 4767 None true false Target Domain target domain 0 671 event id Equal Integer None And false 0 671 None target domain name 0 4767 event id Equal Integer None And false 0 4767 None true false Date date true false Time time true false 0 671 event id Equal Integer None Or false 2 671 None 1 4767 event id Equal Integer None And false 0 4767 None 1 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Unlocked AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 30e2a1b7-eb54-4244-b526-487ea9561e78 User Account Renamed The section is based on event 685(4781 - Vista/Longhorn). Verify that the user performing the attempt corresponds to an authorized person or process. Item false User Renaming The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Old Account Name old account name 0 685 event id Equal Integer None And false 0 685 None old target user name 0 4781 event id Equal Integer None And false 0 4781 None true false New Account Name new target user name 0 4781 event id Equal Integer None And false 0 4781 None new account name 0 685 event id Equal Integer None And false 0 685 None true false Date date true false Time time true false 0 685 event id Equal Integer None Or false 2 685 None 1 4781 event id Equal Integer None And false 0 4781 None 1 security log name Equal String None Or false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Renamed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8cd1aecb-6689-47f0-9866-ebf6d010fe4d User account operations distribution Item false Operation Name Account Created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None Or false 0 security None Account Enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None Or false 0 security None Account Disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None Or false 0 security None Account Deleted FixedValue 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None Or false 0 security None Account Unlocked FixedValue 0 671 event id Equal Integer None Or false 2 671 None 1 4767 event id Equal Integer None And false 0 4767 None 1 security log name Equal String None Or false 0 security None Account Renamed FixedValue 0 685 event id Equal Integer None Or false 2 685 None 1 4781 event id Equal Integer None And false 0 4781 None 1 security log name Equal String None Or false 0 security None Account Changed FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4738 event id Equal Integer None And false 0 4738 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false % KeyCountPercentage SpecialColumn true false 0 642 event id Equal Integer None Or false 1 642 None 0 624 event id Equal Integer None Or false 0 624 None 0 4720 event id Equal Integer None Or false 0 4720 None 0 626 event id Equal Integer None Or false 0 626 None 0 4722 event id Equal Integer None Or false 0 4722 None 0 629 event id Equal Integer None Or false 0 629 None 0 4725 event id Equal Integer None Or false 0 4725 None 0 4726 event id Equal Integer None Or false 0 4726 None 0 630 event id Equal Integer None Or false 0 630 None 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None Top Pie Operation Name Account Created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None Or false 0 security None Account Enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None Or false 0 security None Account Disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None Or false 0 security None Account Deleted FixedValue 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None Or false 0 security None Account Unlocked FixedValue 0 671 event id Equal Integer None Or false 2 671 None 1 4767 event id Equal Integer None And false 0 4767 None 1 security log name Equal String None Or false 0 security None Account Renamed FixedValue 0 685 event id Equal Integer None Or false 2 685 None 1 4781 event id Equal Integer None And false 0 4781 None 1 security log name Equal String None Or false 0 security None Account Changed FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4738 event id Equal Integer None And false 0 4738 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User account operations distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4ec804d0-abfc-49e3-af1b-e39ca551934c User Account Changed The section is based on event 642(4738 - Vista/Longhorn). This event records changes made to security-related properties of user accounts. Item false User Changing The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4738 event id Equal Integer None And false 0 4738 None true false Date date true false Time time true false 0 642 event id Equal Integer None Or false 2 642 None 1 4738 event id Equal Integer None And false 0 4738 None 1 security log name Equal String None And false 0 security None 91b461df-2536-413a-a099-51f6e5e16865 true 2011-12-21T12:33:45.8825209+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - User Account Management\Copy of User Account Changed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 06c90f06-7859-49e5-bdbe-a5ea31afff7f PCI DSS Requirement 7.1 - Security Group Management Security Group Management Report for PCI DSS requirement 7.1 - Placement of users into security groups, particularly users who have high privileges such as Domain, Schema, or Enterprise Admins, should occur within policy guidelines only, and should make use of established and approved accounts or processes. The report will help you identify the critical operations. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c02258ba-8884-4d52-bf8b-9525b6be1fc9 PCI DSS Requirement 8.5.1 - User Account Management User Account Management Report for PCI DSS requirement 8.5.1 - The reports will help you achieve the following goals: Find irregular or unusual network account activities, identify administrators who abuse privileges to create or modify accounts and detect patterns of account activities that breach organizational security policies. The reports can also serve as restore data for the unauthorized operations related to user account management - the operations can be undone using the information in these reports. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c1dd1110-dca5-4aef-b333-575c044936d9 User Account Created The section is based on event 624(4720 - Vista/Longhorn). Only authorized people and processes should create network accounts. Examine the user performing the attempt field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. Item false User Creating The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Logon ID caller logon id true false New Account Name new account name 0 624 event id Equal Integer None And false 0 624 None target user name 0 4720 event id Equal Integer None And false 0 4720 None true false Date date true false Time time true false 0 624 event id Equal Integer None Or false 1 624 None 1 4720 event id Equal Integer None And false 0 4720 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a80c2ae6-bb60-42a5-b037-33778d16cc9f User Account Enabled The section is based on event 626(4722 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person enabling the accounts is authorized. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 626 event id Equal Integer None And false 0 626 None target user name 0 4722 event id Equal Integer None And false 0 4722 None true false Target Domain target domain 0 626 event id Equal Integer None And false 0 626 None target domain name 0 4722 event id Equal Integer None And false 0 4722 None true false Date date true false Time time true false 0 626 event id Equal Integer None Or false 1 626 None 1 4722 event id Equal Integer None And false 0 4722 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Enabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0fd337d6-a763-4453-b3bf-63016ae31a0f User Account Disabled The section is based on event 629(4725 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person disabling the accounts is authorized and that he or she verified the reasons why the accounts were disabled prior to enabling the accounts. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 629 event id Equal Integer None And false 0 629 None target user name 0 4725 event id Equal Integer None And false 0 4725 None true false Taget Domain target domain 0 629 event id Equal Integer None And false 0 629 None target domain name 0 4725 event id Equal Integer None And false 0 4725 None true false Date date true false Time time true false 0 629 event id Equal Integer None Or false 1 629 None 1 4725 event id Equal Integer None And false 0 4725 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Disabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7a66ac7f-5f9f-46ef-8ae2-7673864911dc User Account Deleted The section is based on event 630(4726 - Vista/Longhorn). Only authorized people and processes should delete network accounts. Search for these events and examine the user performing the attempt field to detect if unauthorized people have deleted accounts. Item false User Deleting The Account User Managing Accounts SpecialColumn true false Computer true false Type type true false Target Account Name 0 642 event id Equal Integer None And false 0 642 None 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain 0 642 event id Equal Integer None And false 0 642 None 0 4729 event id Equal Integer None And false 0 4729 None true false Date date true false Time time true false 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1df201b2-f022-46fd-9b5a-4d7656cde4a5 User Account Unlocked The section is based on event 671(4767 - Vista/Longhorn) and lists all the accounts which were unlocked. Verify that the person unlocking the accounts is authorized and that he or she verified the reasons for the account lockouts prior to unlocking the accounts. Item false User Unlocking The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 671 event id Equal Integer None And false 0 671 None target user name 0 4767 event id Equal Integer None And false 0 4767 None true false Target Domain target domain 0 671 event id Equal Integer None And false 0 671 None target domain name 0 4767 event id Equal Integer None And false 0 4767 None true false Date date true false Time time true false 0 671 event id Equal Integer None Or false 1 671 None 1 4767 event id Equal Integer None And false 0 4767 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Unlocked AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 19fbfbb7-6035-4c62-a533-1a5f6c70ff35 User Account Renamed The section is based on event 685(4781 - Vista/Longhorn). Verify that the user performing the attempt corresponds to an authorized person or process. Item false User Renaming The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Old Account Name old account name 0 685 event id Equal Integer None And false 0 685 None old target user name 0 4781 event id Equal Integer None And false 0 4781 None true false New Account Name new target user name 0 4781 event id Equal Integer None And false 0 4781 None new account name 0 685 event id Equal Integer None And false 0 685 None true false Date date true false Time time true false 0 685 event id Equal Integer None Or false 1 685 None 1 4781 event id Equal Integer None And false 0 4781 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Renamed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e10904fd-6f2c-4f21-855e-165386ed7b91 User Account Changed The section is based on event 642(4738 - Vista/Longhorn). This event records changes made to security-related properties of user accounts. Item false User Changing The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4738 event id Equal Integer None And false 0 4738 None true false Date date true false Time time true false 0 642 event id Equal Integer None Or false 1 642 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User Account Changed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 984310fb-bbee-4420-855c-d5030684215f PCI DSS Requirement 8.5.1 - Password Changes Report Password Changes for PCI DSS requirement 8.5.1 - Password resets should occur within an approved framework only. Properly configured security audit levels should record password resets in the security event logs and identify those resets that do not follow the correct procedures. The reports may contain the following sections: "Change password attempts", "User account password set or reset" and "Changes to directory service restore mode passwords". Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:35:07.7322024+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Password Changes Report 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bb3765da-3b3a-468d-8aba-b64ac013f302 Change Password Attempts The section shows password change attempts based on the 627(4723 - Vista/Longhorn) event. Compare the user trying to change the password with the Target Account Name to determine whether the account owner or someone else attempted to change the password. If the user trying to change the password does not equal the Target Account Name, someone other than the account owner tried to change the password. Check if the user trying to change the password is authorized to perform password changes.The failed attempts to change passwords are very important for security monitoring and may signal intruders trying to compromise user accounts. Therefore they are highlighted in light red in the report. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name true false Date date true false Time time true false 0 627 event id Equal Integer None Or false 1 627 None 1 4723 event id Equal Integer None And false 0 4723 None 0 security log name Equal String None And false 0 security None 984310fb-bbee-4420-855c-d5030684215f true 2011-12-21T12:35:07.7322024+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Password Changes Report\Copy of Change Password Attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 13aeb4d4-8a22-4796-9dd2-7c837173ef7d User Account Password Set Or Reset The section, based on the 628(4724 - Vista/Longhorn) event, shows when a user or process resets an account password through an administrative interface such as Active Directory Users and Computers, rather than through a password change process. Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. Item false subject user sid subject user sid true false Computer computer true false Type type true false Target Account target account name true false Date date true false Time time true false 0 628 event id Equal Integer None Or false 1 628 None 1 4724 event id Equal Integer None And false 0 4724 None 0 security log name Equal String None And false 0 security None 984310fb-bbee-4420-855c-d5030684215f true 2011-12-21T12:35:07.7322024+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Password Changes Report\Copy of User Account Password Set Or Reset AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e4a20b0d-f8fc-416f-a75f-8d3118461877 Changes To Dir. Services Restore Mode Password The section, based on the 698(4794 - Vista/Longhorn) event, shows when someone attempts to change the Directory Services Restore Mode password on a domain controller. Check Source Machine and the user performing the attempt and investigate immediately. Item false User trying to change the password User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Source Machine scanned computer true false Date date true false Time time true false 0 698 event id Equal Integer None Or false 1 698 None 1 4794 event id Equal Integer None And false 0 4794 None 0 security log name Equal String None And false 0 security None 984310fb-bbee-4420-855c-d5030684215f true 2011-12-21T12:35:07.7322024+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Password Changes Report\Copy of Changs To Dir. Services Restore Mode Password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d26e0f0d-8b16-437e-9c81-b43c1bd6a98b PCI DSS Requirement 10.2.2 - All Actions Taken by Any Individual with Root or Administrative Privileges All Actions Taken by Any Individual with Root or Administrative Privileges Report for PCI DSS requirement 10.2.2 - The report shows the activity performed by users who have administrative privileges. The product uses advanced techniques to determine the following, for each event log entry: what is the user account that caused the event log entry, does the account have administrative privileges and if not, did the account have administrative privileges at the time the log entry was created. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 Yes isadmin Equal Integer None And false 0 1 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:35:22.1990299+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6f9081df-5415-4fcf-bc99-bb2a51b761b6 PCI DSS Requirement 10.2.3 - Access to All Audit Trails Access to All Audit Trails Report for PCI DSS requirement 10.2.3 - The report shows audit log related activity such as: audit log cleared, successful or failed attempts to access the audit logs and physical (using file managers) access to .evt files. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 517 event id Equal Integer None Or false 2 517 None 1 1102 event id Equal Integer None Or false 0 1102 None 0 578 event id Equal Integer None Or false 2 578 None 1 4674 event id Equal Integer None And false 0 4674 None 1 EventLog object type Equal String None Or false 0 EventLog None 0 560 event id Equal Integer None Or false 1 560 None 2 4656 event id Equal Integer None And false 0 4656 None 0 file object type Equal String None And false 0 file None 0 .evt object name Contains String None And false 0 .evt None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:35:25.9182426+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 527590e6-08d1-4c62-9654-6b8a6295187b PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts Invalid Logical Access Attempts Report for PCI DSS requirement 10.2.4 - The report shows invalid logical access attempts such as: failed logons, account lockouts, attempts to use unauthorized resources and attempts to use unauthorized applications. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:35:32.4036135+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 859fc489-541d-481b-832b-9add8fff75e0 Possible attempts to access unauthorized resources - Failed attempts to access any objects other than AD related The report shows failed attempts to access any objects other than AD related Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None Or false 0 16 None 527590e6-08d1-4c62-9654-6b8a6295187b true 2011-12-21T12:35:32.4036135+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts\Copy of PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 89eb5363-219b-49e6-94a6-ea8c2495095f Account lockouts The report shows invalid logical access attempts such as account lockouts Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event caller machine name true false Identity or name of affected data, resource or component caller user name true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 644 event id Equal Integer None Or false 1 644 None 0 602 event id Equal Integer None Or false 0 602 None 0 4740 event id Equal Integer None Or false 0 4740 None 1 4698 event id Equal Integer None Or false 0 4698 None 527590e6-08d1-4c62-9654-6b8a6295187b true 2011-12-21T12:35:32.4036135+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts\Copy of Possible attempts to access unauthorized resources - Failed attempts to access any objects other than AD related AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f5ae5a07-d4a0-487a-867e-f4f50bebddf0 Failed logons reasons other than bad user name or password The report shows invalid logical access attempts such as failed logons reasons other than bad user name or password Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component monitored machine true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 529 event id GreaterThan Integer None And false 2 529 None 1 536 event id LessThan Integer None Or false 0 536 None 1 4625 event id Equal Integer None Or false 0 4625 None 527590e6-08d1-4c62-9654-6b8a6295187b true 2011-12-21T12:35:32.4036135+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.4 - Invalid Logical Access Attempts\Copy of Account lockouts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 422f119b-5294-4a9e-b5b8-550f13a16881 PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e34d7e0e-cae9-4599-9e3b-d33762e52b95 Kerberos pre-authentication failed Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification user id true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component source true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 675 event id Equal Integer None Or false 0 675 None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of Failed logons because of bad user name and password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 94841fca-8f03-427e-b867-d29db416f42a Kerberos service ticket requests Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event client address true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 673 event id Equal Integer None Or false 1 673 None 1 675 event id Equal Integer None And false 0 675 None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of Failed logons because of bad user name and password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2cd483ff-309d-4e62-a6d5-736158ebca37 NTLM Logon attemtps Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification logon account 0 680 event id Equal Integer None And false 0 680 None the logon to account 0 681 event id Equal Integer None And false 0 681 None user name 0 683 event id Equal Integer None And false 0 683 None true false Type of event category true false Success or Failure Indication type true false Origination of event workstation 0 4776 event id Equal Integer None And false 0 4776 None source workstation 0 680 event id Equal Integer None And false 0 680 None true false Identity or name of affected data, resource or component monitored machine true false Description Description SpecialColumn true false Date date true false Time time true false 0 680 event id Equal Integer None Or false 1 680 None 0 681 event id Equal Integer None Or false 0 681 None 0 683 event id Equal Integer None Or false 0 683 None 0 4777 event id Equal Integer None Or false 0 4777 None 0 580 event id Equal Integer None Or false 0 580 None 1 4776 event id Equal Integer None And false 0 4776 None 0 security log name Equal String None Or false 0 security None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of Failed logons because of bad user name and password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 cceae69f-2ee9-4fce-a1d4-68238ba1f022 PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs Initialization of the Audit Logs Report for PCI DSS requirement 10.2.6 - The report shows information related to the initialization and functionality of the audit logs, such as: failure to audit because of various reasons (event log full, log file corrupt, lack of resources, etc), the errors logged by the event log service and the events signaling that the EventLog service has started or stopped. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:36:07.4516182+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0e9d8b37-b23d-4727-bde8-f866b4e49b63 Event log full Initialization of the Audit Logs Report for PCI DSS requirement 10.2.6 - The report shows information related to the initialization and functionality of the audit logs, such as: failure to audit because of various reasons (event log full, log file corrupt, lack of resources, etc), the errors logged by the event log service and the events signaling that the EventLog service has started or stopped. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component Audit Log FixedValue true false Description Description SpecialColumn true false Date date true false Time time true false 0 6000 event id Equal Integer None And false 0 6000 None 0 security log name Equal String None Or false 1 security None 1 system log name Equal String None And false 0 system None cceae69f-2ee9-4fce-a1d4-68238ba1f022 true 2011-12-21T12:36:07.4516182+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs\Copy of PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ea10ec6a-9bf3-4dcf-9f37-3507bea1ab16 Event log service started Initialization of the Audit Logs Report for PCI DSS requirement 10.2.6 - The report shows information related to the initialization and functionality of the audit logs, such as: failure to audit because of various reasons (event log full, log file corrupt, lack of resources, etc), the errors logged by the event log service and the events signaling that the EventLog service has started or stopped. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component source true false Description Description SpecialColumn true false Date date true false Time time true false 0 6005 event id Equal Integer None And false 0 6005 None 0 security log name Equal String None Or false 1 security None 1 system log name Equal String None And false 0 system None cceae69f-2ee9-4fce-a1d4-68238ba1f022 true 2011-12-21T12:36:07.4516182+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs\Copy of Event log full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 63ca691b-0c89-422e-89a5-6f582fb57bf3 Event log service stopped Initialization of the Audit Logs Report for PCI DSS requirement 10.2.6 - The report shows information related to the initialization and functionality of the audit logs, such as: failure to audit because of various reasons (event log full, log file corrupt, lack of resources, etc), the errors logged by the event log service and the events signaling that the EventLog service has started or stopped. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component source true false Description Description SpecialColumn true false Date date true false Time time true false 0 6006 event id Equal Integer None And false 0 6006 None 0 security log name Equal String None Or false 1 security None 1 system log name Equal String None And false 0 system None cceae69f-2ee9-4fce-a1d4-68238ba1f022 true 2011-12-21T12:36:07.4516182+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.6 - Initialization of the Audit Logs\Copy of Event log service started AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a558f9ac-c9c5-4e38-befe-3029952d7d06 PCI DSS Requirement 10.2.7 - Creation and Deletion of System-Level Objects Creation and Deletion of System-Level Objects Report for PCI DSS requirement 10.2.7 - The report shows information related to the manipulation of system level objects such as: access to Active Directory objects, deletion of Active Directory objects, deletion of generic objects and the events logged by the Windows File Protection service in case system files are being tampered with. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 63999 event id GreaterThan Integer None And false 1 63999 None 1 64009 event id LessThan Integer None And false 0 64009 None 0 security log name Equal String None Or false 1 security None 1 system log name Equal String None And false 0 system None 0 Windows File Protection source Contains String None And false 0 Windows File Protection None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:01:43.2964635+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 10.2.1 - All Individual Access to Cardholder Data Stored in Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 55523a1b-842f-416c-a94a-77235094e54d PCI DSS Requirement 10.4 - Time Synchronization Monitoring Time Synchronization Monitoring Report for PCI DSS requirement 10.4 - The report shows information related to time synchronization such as: system time changes and activity reported by the Windows Time Service. Item false User Identification User Identification SpecialColumn 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None Or false 0 4616 None Fully Qualified User Name SpecialColumn true false Type Of Event category true false Date date true false Time time true false Success Or Failure Indication type true false Origination Of Event monitored machine true false Identity or name of affected data, resource or component System Time SpecialColumn 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None And false 0 4616 None source true false Description Description SpecialColumn true false 0 W32time source Contains String None And false 1 W32time None 1 system log name Equal String None Or false 0 system None 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None And false 0 4616 None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:01:46.504647+02:00 Daily 1 false false PCI DSS Compliance\Copy of GCSx Code Of Connection Memo 22 SR1 - Time Synchronization Monitoring AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 eee12939-e7b3-4c11-8de8-a00798532c2c PCI DSS Requirement 7.1 - System Access Granted/Removed System Access Granted/Removed Report for PCI DSS requirement 7.1 - The report will list for each computer, the users that have been granted system access. This will help determine who has been given access to particular computers in the network. Item false Computer monitored machine true true Account Modified account modified 0 621 event id Equal Integer None Or false 0 621 None 0 622 event id Equal Integer None Or false 0 622 None target sid 0 4717 event id Equal Integer None Or false 0 4717 None 0 4718 event id Equal Integer None Or false 0 4718 None true false By User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Privilege access granted 0 621 event id Equal Integer None Or false 0 621 None 0 4717 event id Equal Integer None Or false 0 4717 None access removed 0 622 event id Equal Integer None Or false 0 622 None 0 4718 event id Equal Integer None Or false 0 4718 None true false Date date true false Time time true false 0 621 event id Equal Integer None Or false 1 621 None 0 622 event id Equal Integer None Or false 0 622 None 0 4717 event id Equal Integer None Or false 0 4717 None 1 4718 event id Equal Integer None And false 0 4718 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:01:48.8567815+02:00 Daily 1 false false PCI DSS Compliance\Copy of GCSx Code Of Connection Memo 22 SR7 - System Access Granted/Removed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 69c570a0-b3c8-4c00-bd31-17e2efe228db PCI DSS Requirement 8.5.1 - Security Group Management Security Group Management Report for PCI DSS requirement 8.5.1 - Placement of users into security groups, particularly users who have high privileges such as Domain, Schema, or Enterprise Admins, should occur within policy guidelines only, and should make use of established and approved accounts or processes. The report will help you identify the critical operations as well as undo operations that were unauthorized or inappropriate. Container false 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 28b51e58-aede-45d7-96c5-9967a4dae1eb PCI DSS Requirement 8.5.1 - System Access Granted/Removed System Access Granted/Removed Report for PCI DSS requirement 8.5.1 - The report will list for each computer, the users that have been granted system access. This will help determine who has been given access to particular computers in the network. The data in the report can be used to undo the operations that were unauthorized. Item false Computer monitored machine true true Account Modified account modified 0 621 event id Equal Integer None Or false 0 621 None 0 622 event id Equal Integer None Or false 0 622 None target sid 0 4717 event id Equal Integer None Or false 0 4717 None 0 4718 event id Equal Integer None Or false 0 4718 None true false By User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Privilege access granted 0 621 event id Equal Integer None Or false 0 621 None 0 4717 event id Equal Integer None Or false 0 4717 None access removed 0 622 event id Equal Integer None Or false 0 622 None 0 4718 event id Equal Integer None Or false 0 4718 None true false Date date true false Time time true false 0 621 event id Equal Integer None Or false 1 621 None 0 622 event id Equal Integer None Or false 0 622 None 0 4717 event id Equal Integer None Or false 0 4717 None 1 4718 event id Equal Integer None And false 0 4718 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:02:11.4050712+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 7.1 - System Access Granted/Removed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 30515105-4590-45f5-8254-ec26f077d49c PCI DSS Requirement 15.4 - Deleted Files Deleted Files Report for PCI DSS requirement 15.4 - The report lists the deleted file throughout the network. It will help you identify if there are any critical files being deleted. Item false Computer monitored machine true false Username Fully Qualified User Name SpecialColumn true false Object Name object name true false Object Type object type true false Image File Name image file name true false Object Server object server true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 0 564 event id Equal Integer None Or false 0 564 None 0 4656 event id Equal Integer None Or false 0 4656 None 1 4660 event id Equal Integer None And false 0 4660 None 0 file object type Equal String None And false 0 file None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:02:14.3052371+02:00 Daily 1 false false PCI DSS Compliance\Copy of GCSx Code Of Connection Memo 22 - Deleted Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3ccc6ca0-cd96-4734-8cc5-8f080af2bdef Kerberos failed events The section is based on events 675(4771-Vista/Longhorn) -Pre-authentication failed, 676(4772 - Vista/Longhorn) - Authentication Ticket Request failed, and 677 (4773 - Vista/Longhorn) – Service ticket request failed. Event 675 is recorded both in Windows 2000 and Windows 2003 domains. In a Windows 2000 domain, events 676 and 677 are logged for failed authentication /service ticket request.domain, events 676 and 677 are logged for failed authentication /service ticket request. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Service Name service name true false Client Address client address true false Failure Code failure code true false Time time true false Date date true false 0 674 event id GreaterThan Integer None And false 2 674 None 1 678 event id LessThan Integer None Or false 0 678 None 0 4770 event id GreaterThan Integer None And false 1 4770 None 2 4774 event id LessThan Integer None And false 0 4774 None 0 security log name Equal String None And false 0 security None 331b532d-21cd-4c18-9412-4e945477ebe0 true 2011-12-21T12:32:55.2056223+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 11.4 - Account Logons\Copy of Kerberos service ticket requests AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d83de79f-f776-4570-8141-e96f003a4569 PCI DSS Requirement 11.4 - Network Activity Report Grouped by Destination This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application name true false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Destination Address destination address true true Destination Port destination port true false Source Address source address true false Source Port source port true false Direction direction true false Protocol protocol true false Time time true false Date date true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 1d06bb61-1e63-4dd0-9c3e-4b35d35a06d8 true 2011-12-21T13:02:17.2994083+02:00 Daily 1 false false PCI DSS Compliance\Copy of PCI DSS Requirement 11.4 - Network Activity Report Grouped by Direction AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ae70fcf9-2784-463d-bb5b-67d331e74eed GCSx Code Of Connection Memo 22 SR7 - System Access Granted/Removed The report will list for each computer, the users that have been granted system access. This will help determine who has been given access to particular computers in the network Item false Computer monitored machine true true Account Modified account modified 0 621 event id Equal Integer None Or false 0 621 None 0 622 event id Equal Integer None Or false 0 622 None target sid 0 4717 event id Equal Integer None Or false 0 4717 None 0 4718 event id Equal Integer None Or false 0 4718 None true false By User Fully Qualified User Name SpecialColumn true false Event Description Event Description SpecialColumn true false Privilege access granted 0 621 event id Equal Integer None Or false 0 621 None 0 4717 event id Equal Integer None Or false 0 4717 None access removed 0 622 event id Equal Integer None Or false 0 622 None 0 4718 event id Equal Integer None Or false 0 4718 None true false Date date true false Time time true false 0 621 event id Equal Integer None Or false 1 621 None 0 622 event id Equal Integer None Or false 0 622 None 0 4717 event id Equal Integer None Or false 0 4717 None 1 4718 event id Equal Integer None And false 0 4718 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:31.788237+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - System Access Granted/Removed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9c3646e1-8fcf-4f55-ba53-c8e8b5151c34 GCSx Code Of Connection Memo 22 SR7 - IPSec Policy Changes The report shows the changes to the IPSec policy of the computers being monitored by EventsManager. Item false Computer monitored machine true true UserName Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Date date true false Time time true false 0 613 event id Equal Integer None Or false 1 613 None 0 614 event id Equal Integer None Or false 0 614 None 0 615 event id Equal Integer None Or false 0 615 None 0 4709 event id Equal Integer None Or false 0 4709 None 0 4710 event id Equal Integer None Or false 0 4710 None 1 4711 event id Equal Integer None And false 0 4711 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:34.6484006+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code of Connection Memo 22 SR7 - IPSec Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9b5614a0-e1bd-4e58-9f47-757d7ac33aea GCSx Code Of Connection Memo 22 SR7 - Kerberos Policy Changes The report shows the changes to the Kerberos policy of the computers being monitored by EventsManager. Item false User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Date date true false Time time true false Computer monitored machine true true 0 617 event id Equal Integer None Or false 1 617 None 1 4713 event id Equal Integer None And false 0 4713 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:37.3175533+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code of Connection Memo 22 SR7 - Kerberos Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a207b687-02fa-4493-a489-795673dcf4e1 GCSx Code Of Connection Memo 22 SR1 - Time Synchronization Monitoring The report shows information related to time synchronization such as: system time changes and activity reported by the Windows Time Service. Item false User Identification User Identification SpecialColumn 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None Or false 0 4616 None Fully Qualified User Name SpecialColumn true false Type Of Event category true false Date date true false Time time true false Success Or Failure Indication type true false Origination Of Event monitored machine true false Identity or name of affected data, resource or component System Time SpecialColumn 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None And false 0 4616 None source true false Description Description SpecialColumn true false 0 W32time source Contains String None And false 1 W32time None 1 system log name Equal String None Or false 0 system None 0 520 event id Equal Integer None Or false 0 520 None 0 4616 event id Equal Integer None And false 0 4616 None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:40.0647104+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR1 - Time Synchronization Monitoring AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 101350ca-1264-42c8-95d3-8db368fab993 GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application true false User Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Destination Address destination address true false Destination Port destination port true false Source Address source address true false Source Port source port true false Direction direction true false Protocol protocol true false Date date true false Time time true false importance importance true true 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 0 High importance Equal Integer None Or false 1 3 None 1 Critical importance Equal Integer None Or false 0 4 None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:42.416845+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 396878ee-47e4-4fc9-89eb-bc0d93e27566 GCSx Code Of Connection Memo 22 - Successful Logons Grouped By Computers This report lists all successful logons grouped by computers helping you identify who are the users logging on certain machines. Item false Computer monitored machine true true User Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id Equal Integer None Or false 1 528 None 0 540 event id Equal Integer None Or false 0 540 None 0 4624 event id Equal Integer None Or false 0 4624 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:45.0439952+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 - Successful Logons Grouped By Computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c79b5400-c9de-4ebb-9a2e-dd34f08fdf04 GCSx Code Of Connection Memo 22 - Successful Logons Grouped by Users This report lists all successful logons grouped by users, helping you determine what are the computers a certain user has logged on to. Item false User name Fully Qualified User Name SpecialColumn true true Computer monitored machine true false Event ID event id true false description id Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id Equal Integer None Or false 1 528 None 0 540 event id Equal Integer None Or false 0 540 None 0 4624 event id Equal Integer None Or false 0 4624 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:47.6931468+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 - Successful Logons Grouped by Users AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c3e50e5d-3b6b-4d45-9230-5a6ca805d081 GCSx Code Of Connection ISO 27002 10.10 - Server Uptime The report shows the uptime of the monitored machines. Item false Computer monitored machine true false Server Uptime (HH:MM:SS) Uptime SpecialColumn true false Date date true false Time time true false 0 6013 event id Equal Integer None And false 0 6013 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:49.9612765+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Server Uptime AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9aaeeaf1-bbb6-4b1d-8934-920e4ce80635 GCSx Code Of Connection ISO 27002 10.10.2 - Generic Windows Event Log The report provides very flexible filtering and grouping options allowing monitoring of particular systems running Windows operating systems. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Source source true false Description Description SpecialColumn true false Type type true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:52.4584193+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.2 - Generic Windows Event Log AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d419568e-955f-4361-a016-9ce44ae56eba GCSx Code Of Connection ISO 27002 10.10.2 - Generic Syslog The report provides very flexible filtering and grouping options allowing monitoring of particular systems running Linux /Unix operating systems as well as network devices that are Syslog-enabled. Item false Computer monitored machine true false Message message true false Facility facility true false Severity severity true false Date date true false Time time true false 0 syslog log format Equal String None And false 0 syslog None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:55.3585852+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.2 - Generic Syslog AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ee2ac27d-36fe-4e22-8824-645c431158de GCSx Code Of Connection Memo 22 - Deleted Files The report lists the deleted file throughout the network. It will help you identify if there are any critical files being deleted. Item false Computer monitored machine true false Username Fully Qualified User Name SpecialColumn true false Object Name object name 0 4660 event id Equal Integer None And false 0 4660 None resource name 0 564 event id Equal Integer None And false 0 564 None true false Object Type resource type true false Image File Name image file name 0 564 event id Equal Integer None And false 0 564 None process name 0 4660 event id Equal Integer None And false 0 4660 None true false Object Server object server true false Date date true false Time time true false 0 564 event id Equal Integer None And false 2 564 None 1 File resource type Contains String None Or false 0 File None 0 4660 event id Equal Integer None And false 1 4660 None 2 File category Contains String None And false 0 File None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:02:59.0907987+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 - Deleted Files AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b61a36f2-be02-4012-82b8-ebfca1078224 SOX 302.a.6 - Account Management The report will help you achieve the following goals: Find irregular or unusual network account activities, identify administrators who abuse privileges to create or modify accounts and detect patterns of account activities that breach organizational security policies. Container false d73c7313-ed40-49ae-b591-3da197e02ad6 true 1800-01-01T00:00:00 None false SOX Compliance\SOX 302.a.6 - Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4a6c4032-d80a-49eb-8600-21e7878fb864 User Account Created The section is based on event 624(4720 - Vista/Longhorn). Only authorized people and processes should create network accounts. Examine the user performing the attempt field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. Item false User Creating The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Logon ID caller logon id true false New Account Name new account name 0 624 event id Equal Integer None And false 0 624 None target user name 0 4720 event id Equal Integer None And false 0 4720 None true false Date date true false Time time true false 0 624 event id Equal Integer None Or false 1 624 None 1 4720 event id Equal Integer None And false 0 4720 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:50:53.4306396+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\User account created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a6da98bb-e59b-47fc-a035-2c6e3b5193f8 User Account Enabled The section is based on event 626(4722 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person enabling the accounts is authorized. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 626 event id Equal Integer None And false 0 626 None target user name 0 4722 event id Equal Integer None And false 0 4722 None true false Target Domain target domain 0 626 event id Equal Integer None And false 0 626 None target domain name 0 4722 event id Equal Integer None And false 0 4722 None true false Date date true false Time time true false 0 626 event id Equal Integer None Or false 1 626 None 1 4722 event id Equal Integer None And false 0 4722 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:50:56.1387945+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\User Account Enabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b2a5ce38-3a74-4fda-acf2-30b4aac9625b User Account Disabled The section is based on event 629(4725 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person disabling the accounts is authorized and that he or she verified the reasons why the accounts were disabled prior to enabling the accounts. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 629 event id Equal Integer None And false 0 629 None target user name 0 4725 event id Equal Integer None And false 0 4725 None true false Taget Domain target domain 0 629 event id Equal Integer None And false 0 629 None target domain name 0 4725 event id Equal Integer None And false 0 4725 None true false Date date true false Time time true false 0 629 event id Equal Integer None Or false 1 629 None 1 4725 event id Equal Integer None And false 0 4725 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:50:58.7069414+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\User Account Disabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 86395752-3428-4994-9234-4eca4b655de2 User Account Unlocked The section is based on event 671(4767 - Vista/Longhorn) and lists all the accounts which were unlocked. Verify that the person unlocking the accounts is authorized and that he or she verified the reasons for the account lockouts prior to unlocking the accounts. Item false User Unlocking The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 671 event id Equal Integer None And false 0 671 None target user name 0 4767 event id Equal Integer None And false 0 4767 None true false Target Domain target domain 0 671 event id Equal Integer None And false 0 671 None target domain name 0 4767 event id Equal Integer None And false 0 4767 None true false Date date true false Time time true false 0 671 event id Equal Integer None Or false 1 671 None 1 4767 event id Equal Integer None And false 0 4767 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:51:01.410096+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\User Account Unlocked AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b74f75b3-931e-4a6e-9557-3b6d9e133409 User Account Renamed The section is based on event 685(4781 - Vista/Longhorn). Verify that the user performing the attempt corresponds to an authorized person or process. Item false User Renaming The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Old Account Name old account name 0 685 event id Equal Integer None And false 0 685 None old target user name 0 4781 event id Equal Integer None And false 0 4781 None true false New Account Name new target user name 0 4781 event id Equal Integer None And false 0 4781 None new account name 0 685 event id Equal Integer None And false 0 685 None true false Date date true false Time time true false 0 685 event id Equal Integer None Or false 1 685 None 1 4781 event id Equal Integer None And false 0 4781 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:51:04.1862548+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\Account Name Changed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 69963a76-678e-40b9-bdce-78a0d98f530e SOX 302.a.6 - Group Management Placement of users into security groups, particularly users who have high privileges such as Domain, Schema, or Enterprise Admins, should occur within policy guidelines only, and should make use of established and approved accounts or processes. The report will help you identify the critical operations. Container false d73c7313-ed40-49ae-b591-3da197e02ad6 true 1800-01-01T00:00:00 None false SOX Compliance\SOX 302.a.6 - Group Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8f02bc8f-7002-4409-b2b7-1286a0caff2e SOX 302.a.5 - Password Policy Changes Password resets should occur within an approved framework only. Properly configured security audit levels should record password resets in the security event logs and identify those resets that do not follow the correct procedures. The report may contain the following sections: "Change password attempts", "User account password set or reset" and "Changes to directory service restore mode passwords". Container false d73c7313-ed40-49ae-b591-3da197e02ad6 true 1800-01-01T00:00:00 None false SOX Compliance\SOX 302.a.5 - Password Policy Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c2a6fd53-3fb9-46d7-b875-1451f4d8c992 Change Password Attempts The section shows password change attempts based on the 627(4723 - Vista/Longhorn) event. Compare the user trying to change the password with the Target Account Name to determine whether the account owner or someone else attempted to change the password. If the user trying to change the password does not equal the Target Account Name, someone other than the account owner tried to change the password. Check if the user trying to change the password is authorized to perform password changes.The failed attempts to change passwords are very important for security monitoring and may signal intruders trying to compromise user accounts. Therefore they are highlighted in light red in the report. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name true false Date date true false Time time true false 0 627 event id Equal Integer None Or false 1 627 None 1 4723 event id Equal Integer None And false 0 4723 None 0 security log name Equal String None And false 0 security None 8f02bc8f-7002-4409-b2b7-1286a0caff2e true 2012-01-20T17:51:34.2509744+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Password Policy Changes\Change Password Attempt AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1d4b83c5-6546-43d7-98fd-f5ee650483f1 User Account Password Set Or Reset The section, based on the 628(4724 - Vista/Longhorn) event, shows when a user or process resets an account password through an administrative interface such as Active Directory Users and Computers, rather than through a password change process. Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name 0 628 event id Equal Integer None And false 0 628 None target user name 0 4724 event id Equal Integer None And false 0 4724 None true false Date date true false Time time true false 0 628 event id Equal Integer None Or false 1 628 None 1 4724 event id Equal Integer None And false 0 4724 None 0 security log name Equal String None And false 0 security None 8f02bc8f-7002-4409-b2b7-1286a0caff2e true 2012-01-20T17:51:37.0511346+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Password Policy Changes\User Account password set AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 019b2406-0d96-4f00-8d96-42bc9cce551d Changes To Dir. Services Restore Mode Password The section, based on the 698(4794 - Vista/Longhorn) event, shows when someone attempts to change the Directory Services Restore Mode password on a domain controller. Check Source Machine and the user performing the attempt and investigate immediately. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Source Machine monitored machine true false Date date true false Time time true false 0 698 event id Equal Integer None Or false 1 698 None 1 4794 event id Equal Integer None And false 0 4794 None 0 security log name Equal String None And false 0 security None 8f02bc8f-7002-4409-b2b7-1286a0caff2e true 2012-01-20T17:51:40.030305+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Password Policy Changes\Setting of Dir. Services Restore password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 06cc67f9-cae0-4557-a332-5ad6971d4b63 GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1648a2ec-1e7f-42d1-9afe-fe798e2a037f Top 10 Computers With The Most Events A bar chart showing the top 10 computers with the most events and a table showing details on the top 10 computers with the most events. Item false Computer monitored machine true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Bars Computer monitored machine true false Event ID event id false false Chart data true None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Top 10 Computers With The Most Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7a9c23df-3646-4057-83bf-c7598e72a386 Top 10 Users Generating The Most Events A bar chart showing the top 10 users generating the most events and a table showing details on the top 10 users generating the most events. Item false User Fully Qualified User Name SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Bars User Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data true None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Top 10 Users Generating The Most Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2c9cf4f5-fbb6-48f8-bd86-1b2c0f6a6a63 GCSx Code Of Connection ISO 27002 10.10 - All Critical Windows Events Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:04:05.4185924+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - All Critical Windows Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 68a07615-d21f-41f2-805f-aa4ca61c0def Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rules rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None Top Bars Rules rule name true false Event ID event id false false Chart data true None 2c9cf4f5-fbb6-48f8-bd86-1b2c0f6a6a63 true 2011-12-21T13:04:05.4185924+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - All Critical Windows Events\Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 30d748d8-0847-403f-94fb-054de3e38c63 All Critical Windows Events A table showing all the events that correspond to the current filtering conditions. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Rule Name rule name true false Date date true false Time time true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None 2c9cf4f5-fbb6-48f8-bd86-1b2c0f6a6a63 true 2011-12-21T13:04:05.4185924+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - All Critical Windows Events\All Critical Windows Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f63463be-3000-4708-bfee-9e6d660c8a8f GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months The report shows the trend of the event collection process indicating the trend of event generation across the network. The report can be used to certify that the collected data goes back 6 months or more. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:04:18.9603669+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b575657c-26d4-4966-8997-bda57587bf20 Top 10 Computers With The Most Events A bar chart showing the top 10 computers with the most events and a table showing details on the top 10 computers with the most events. Item false Computer monitored machine true false Event ID event id false false No. of Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None Top Bars Computer monitored machine true false Event ID event id false false Chart data true None f63463be-3000-4708-bfee-9e6d660c8a8f true 2011-12-21T13:04:18.9603669+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months\Copy of Top 10 Computers With The Most Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 85264d08-4633-4aa8-8c07-885b0b65b2c0 Top 10 Users Generating The Most Events A bar chart showing the top 10 users generating the most events and a table showing details on the top 10 users generating the most events. Item false User Fully Qualified User Name SpecialColumn true false Event ID event id false false No. of Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None Top Bars User Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data true None f63463be-3000-4708-bfee-9e6d660c8a8f true 2011-12-21T13:04:18.9603669+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months\Copy of Top 10 Users Generating The Most Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c4cfa19b-5235-4045-ac3f-35d47e3e0179 Events Trend On All Computers A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one month. Item false Time DistinctMonth SpecialColumn true false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None Top Line Time DistinctMonth SpecialColumn true false Event ID event id false false Chart data false None f63463be-3000-4708-bfee-9e6d660c8a8f true 2011-12-21T13:04:18.9603669+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months\Copy of Events Trend On All Computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e005b459-4608-431d-a98a-47f898d5416f Events Trend On Each Computer A chart showing for each computer the trend of the events. Item false Computer monitored machine true true Time DistinctMonth SpecialColumn true false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 calc1 monitored machine Equal String None And false 0 calc1 None 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 1 directory log name Equal String None And false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Time DistinctMonth SpecialColumn true false Event ID event id false false Chart data false None f63463be-3000-4708-bfee-9e6d660c8a8f true 2011-12-21T13:04:18.9603669+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 GR22 - Generic Event Trend per Months\Copy of Events Trend On Each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a4fb9a7e-a142-45f3-9326-1df162466683 GCSx Code Of Connection Memo 22 SR7 - Security Group Management Placement of users into security groups, particularly users who have high privileges such as Domain, Schema, or Enterprise Admins, should occur within policy guidelines only, and should make use of established and approved accounts or processes. The report will help you identify the critical operations. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d2ac4b33-10f6-4382-ade5-d2c8d9fd401d GCSx Code Of Connection Memo 22 SR7 - Password Changes Password resets should occur within an approved framework only. Properly configured security audit levels should record password resets in the security event logs and identify those resets that do not follow the correct procedures. The report may contain the following sections: "Change password attempts", "User account password set or reset" and "Changes to directory service restore mode passwords". Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:04:53.8813643+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Password Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f80df2f4-9e70-4784-bf58-58aae6dd6620 GCSx Code Of Connection Memo 22 SR7 - User Account Management The report will help you achieve the following goals: Find irregular or unusual network account activities, identify administrators who abuse privileges to create or modify accounts and detect patterns of account activities that breach organizational security policies. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0b3341bf-139d-44f2-a45a-91befa2fffb1 GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing The report is based on the events in the application log with sources "Application Error", "Application Hang" and "DrWatson". The report displays all the applications which crashed or hanged, together with the associated information. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:05:38.720929+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1b96e8ff-af1b-4f7d-92cd-4898f4e334df Applications Which Crashed A table showing details of applications which crashed. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false description id Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1000 event id Equal Integer None Or false 1 1000 None 0 1004 event id Equal Integer None Or false 0 1004 None 1 1005 event id Equal Integer None And false 0 1005 None 0 application log name Equal String None And false 0 application None 0 Application Error source Equal String None And false 0 Application Error None 0b3341bf-139d-44f2-a45a-91befa2fffb1 true 2011-12-21T13:05:38.720929+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing\Application Which Crashed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f772a355-619d-4fdc-ab99-3a87b0e3be72 Applications Which Hanged A table showing applications which hanged. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1002 event id Equal Integer None And false 0 1002 None 0 application log name Equal String None And false 0 application None 0 Application Hang source Equal String None And false 0 Application Hang None 0b3341bf-139d-44f2-a45a-91befa2fffb1 true 2011-12-21T13:05:38.720929+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing\Applications Which Hanged AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 522aff89-2365-4609-9f68-13ae55997ced DrWatson Events A table showing events generated by DrWatson. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 4097 event id Equal Integer None And false 0 4097 None 0 application log name Equal String None And false 0 application None 0 DrWatson source Equal String None And false 0 DrWatson None 0b3341bf-139d-44f2-a45a-91befa2fffb1 true 2011-12-21T13:05:38.720929+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Hanging or Crashing\DrWatson Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 36d4f704-a496-41cc-b4dd-d7579b82c630 GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed The report is based on the events in the application log with source "MsiInstaller". It displays the applications successfully installed/uninstalled using Windows Installer technology, and failed attempts to install or uninstall such applications. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:05:51.4896593+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 69a4908a-799b-49a1-8ac4-e1610d5ef9b0 Applications Successfully Installed A table showing successful application install events. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11707 event id Equal Integer None And false 0 11707 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None 36d4f704-a496-41cc-b4dd-d7579b82c630 true 2011-12-21T13:05:51.4896593+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed\Applications Successfully Installed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7700e50b-99af-4ed4-aa50-1446b272c104 Applications Successfully Uninstalled A table showing successful application uninstall events. Item false Computer monitored machine true false Username Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11724 event id Equal Integer None And false 0 11724 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None 36d4f704-a496-41cc-b4dd-d7579b82c630 true 2011-12-21T13:05:51.4896593+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed\Applications Successfully Uninstalled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9a386e32-9a2f-4671-9b8f-d006de8109b7 Applications Which Failed To Install A table showing failed application install events. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11708 event id Equal Integer None And false 0 11708 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None 36d4f704-a496-41cc-b4dd-d7579b82c630 true 2011-12-21T13:05:51.4896593+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed\Applications Which Failed To Installed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d47d3d7a-703c-464c-90df-de8bcbc3fe29 Applications Which Failed To Uninstall A table showing failed application uninstall events. Item false Computer monitored machine true false Username Fully Qualified User Name SpecialColumn true false description id Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11725 event id Equal Integer None And false 0 11725 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None 36d4f704-a496-41cc-b4dd-d7579b82c630 true 2011-12-21T13:05:51.4896593+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR8 - Applications Installed / Removed\Applications Which Failed To Uninstall AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8c1a1eeb-e0b1-4a98-a0d8-964ac1d493b7 GCSx Code Of Connection Memo 22 SR7 - Domain Policy Changes The report shows the changes to the domain policy of the computers being monitored by EventsManager. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:06:14.6179822+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code of Connection Memo 22 SR7 - Domain Policy Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a3e5f31b-5c19-4047-ba4c-218b2d392b19 GCSx Code Of Connection Memo 22 - SR5 - Network Activity Report Grouped by Destination This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application true false User Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Destination Address destination address true true Destination Port destination port true false Source Address source address true false Source Port source port true false Direction direction true false Protocol protocol true false Date date true false Time time true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:08.187319+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8c5a32a4-081d-4aad-9b23-7cc0226929f0 GCSx Code Of Connection Memo 22 - SR6 - Network Activity Report Grouped by Communication Port This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application true false User Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Destination Address destination address true false Destination Port destination port true true Source Address source address true false Source Port source port true false Direction direction true false Protocol protocol true false Date date true false Time time true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:10.7624662+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e0556371-88f8-45a0-adb1-6035c851cfae GCSx Code Of Connection Memo 22 - SR5 - All Network Activity Report Grouped by Source This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application true false User Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Destination Address destination address true false Destination Port destination port true false Source Address source address true true Source Port source port true false Direction direction true false Protocol protocol true false Date date true false Time time true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:13.3146122+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1a1c797e-dc6e-4edb-bd37-94317dde8f51 GCSx Code Of Connection Memo 22 - GR25 - Network Activity Report Grouped by Direction This report shows the network activity generated by each computer running a Window Vista or newer operating system (including the server family), based on the events logged by the Windows Filtering Platform. The report lists for each computer, the connections being made from / to the computer, the port being used, the source /destination address and more importantly, the process that sends /receives information using the connection. This report helps you identify computers that are already compromised or about to be compromised by malware /viruses as well as identify specific network activity. Item false Application Name application true false User Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Destination Address destination address true false Destination Port destination port true false Source Address source address true false Source Port source port true false Direction direction true true Protocol protocol true false Date date true false Time time true false 0 5156 event id Equal Integer None And false 0 5156 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:15.7427511+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of GCSx Code Of Connection Memo 22 - GR25 - Important Network Activity AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 48660e71-51f9-4580-bba8-33487cdb5bcb User Account Changed The section is based on event 642(4738 - Vista/Longhorn). This event records changes made to security-related properties of user accounts. Item false User Changing The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4738 event id Equal Integer None And false 0 4738 None true false Date date true false Time time true false 0 642 event id Equal Integer None Or false 1 642 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:51:07.1864264+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ca9d9f9d-53eb-439d-8a62-1dbf7b7bfa89 HIPAA 164.308.a.5 - User Logoff This report lists the logoff events on each computer, including the initial logon type. It will help you identify the users successfully ending their sessions. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true true Event ID event id true false Description Description SpecialColumn true false Logon ID logon id true false Logon Type logon type true false Date date true false Time time true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:03.7156597+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - User Logoff AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f7e709a9-e2b9-458e-a02a-c2b1357457d7 HIPAA 164.308.a.5 - Failure Logons This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None And false 0 security None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:07.0108482+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - User Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 02d450a0-c879-4fcb-95e2-e4b0b0223173 HIPAA 164.308.a.5 - User Logon The report shows logon events generated when a user logs on a computer. The report covers all logon types and includes domain logons irrespective of authentication package being used. Item false Computer monitored machine true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false User Name Fully Qualified User Name SpecialColumn true true 0 528 event id Equal Integer None Or false 1 528 None 0 540 event id Equal Integer None Or false 0 540 None 0 4624 event id Equal Integer None Or false 0 4624 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:09.7630056+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - User Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fcbd6086-890a-4f95-91aa-48983e5e7fd4 HIPAA 164.308.a.4 - System Startup/Shutdown This report will display system startup and shutdown events. Item false Event ID event id true false Description Event Description SpecialColumn true false Date date true false Time time true false Computer monitored machine true true 0 6006 event id Equal Integer None Or false 1 6006 None 1 6009 event id Equal Integer None And false 0 6009 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:12.5311639+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - System Startup/Shutdown AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 79ce262b-d0c5-4d13-9ee1-f2988726824d HIPAA 164.308.a.4 - Object Access - Successful Attempts to Access Files and Registry The report will list all the successful attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting successfuly accessing files and registry that are security sensitive. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:15.627341+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - Object Access - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 791f6821-c6ce-4355-93dd-a31e07d6b7f5 HIPAA 164.308.a.4 - Object Access - Failed Attempts to Access Files and Registry The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unathorized users or unathorized applications attempting to access files and registry that are security sensitive and may indicate a breach or a tampering attempt. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:18.547508+02:00 Daily 1 false false HIPAA Compliance\Copy of SOX 302.a.4 - Object Access - Failed Attempts to Access Files And Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8e162397-ff36-4c2e-8982-c599c74420cc GLBA - User Logon The report shows logon events generated when a user loggs on a computer. The report covers all logon types and includes domain logons irrespective of authentication package being used. Item false Computer monitored machine true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false User Name Fully Qualified User Name SpecialColumn true true 0 528 event id Equal Integer None Or false 1 528 None 0 540 event id Equal Integer None Or false 0 540 None 0 4624 event id Equal Integer None Or false 0 4624 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None ce5f479d-ffb2-4346-9c9f-3d93a24ecb8b true 2012-01-20T17:52:26.9939912+02:00 Daily 1 false false GLBA Compliance\Copy of SOX 302.a.4 - User Logon AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 79846e2b-e8fd-479f-8901-982263208c5e GLBA - User Logoff This report lists the logoff events on each computer, including the initial logon type. It will help you identify the users successfully ending their sessions. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true true Event ID event id true false Description Description SpecialColumn true false Logon ID logon id true false Logon Type logon type true false Date date true false Time time true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None ce5f479d-ffb2-4346-9c9f-3d93a24ecb8b true 2012-01-20T17:52:29.7951514+02:00 Daily 1 false false GLBA Compliance\Copy of SOX 302.a.4 - User Logoff AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d3d30311-91a3-4b37-b5c6-176886297ee8 GLBA - Failure Logons This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None And false 0 security None ce5f479d-ffb2-4346-9c9f-3d93a24ecb8b true 2012-01-20T17:52:32.5003061+02:00 Daily 1 false false GLBA Compliance\Copy of SOX 302.a.4 - Failure Logons AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b1616527-ae39-4dd3-8393-7185257a850a GCSx Code Of Connection Memo 22 - Successful Attempts to Access Files and Registry The report will list all the successful attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting successfuly accessing files and registry that are security sensitive. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:18.2158926+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of SOX 302.a.4 - Object Access - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0ccdf388-1855-4f22-ac3a-b0f44b059f88 GCSx Code Of Connection Memo 22 - Failed Attempts to Access Files and Registry The report will list all the failed attempts to access files and registry based on the object access events. The report will help you identify unathorized users or unathorized applications attempting to access files and registry that are security sensitive and may indicate a breach or a tampering attempt. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:20.6990346+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of SOX 302.a.4 - Object Access - Failed Attempts to Access Files And Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 afbd56a6-3bb9-4d12-a789-345b1ee83c2a GCSx Code Of Connection Memo 22 - Failed Logons This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true false Username Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Account Account SpecialColumn true false Logon Type logon type true false Date date true false Time time true false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 0 4625 event id Equal Integer None Or false 0 4625 None 0 675 event id Equal Integer None Or false 0 675 None 1 4771 event id Equal Integer None And false 0 4771 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:23.3781878+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of SOX 302.a.4 - Failure Logons AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c0c7df76-143d-45a1-8183-a8c9ff2db161 GCSx Code Of Connection Memo 22 - Logoffs This report lists the logoff events on each computer, including the initial logon type. It will help you identify the users successfully ending their sessions. Item false Computer monitored machine true false User Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Logon ID logon id true false Logon Type logon type true false Date date true false Time time true false 0 538 event id Equal Integer None Or false 1 538 None 1 4634 event id Equal Integer None And false 0 4634 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:25.8153272+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of SOX 302.a.4 - User Logoff AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 Account Logons When a user logs on to a domain, the log on is processed at a domain controller. If you audit Account Logon events at domain controllers, you will see this logon attempt recorded at the domain controller that validates the account. Account Logon events are created when an authentication package validates a user's credentials. When domain credentials are used, Account Logon events are only generated in the domain controllers' event logs. Container false d174b216-e124-4d51-a43c-373344f897fe true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 49ea5606-367a-4e15-86ab-9592f3ad1633 Kerberos authentication ticket requests The section is based on event 672 (4768 - Vista/Longhorn) - authentication ticket request. This event enables the tracking of initial domain logons through the granting of ticket-granting tickets (TGT). Windows 2003 domain records this event for both success and failure requests. The type field indicates whether the request was successful or not. In Windows 2000 domains, the event only records successful requests. For failed requests in Windows 2000 domains use the 676 event. Item false Computer monitored machine true false Type type 0 4768 event id LessThan Integer None Or false 0 4768 None 0 4768 event id GreaterThan Integer None Or false 0 4768 None Success FixedValue 0 4768 event id Equal Integer None And false 0 4768 None true false User Name Fully Qualified User Name SpecialColumn true false Service Name service name true false Client Address client address 0 672 event id Equal Integer None Or false 1 672 None 1 676 event id Equal Integer None Or false 0 676 None ip address 0 4768 event id Equal Integer None And false 0 4768 None true false Result Code result code true false Date date true false Time time true false 0 672 event id Equal Integer None Or false 1 672 None 0 4768 event id Equal Integer None Or false 0 4768 None 1 676 event id Equal Integer None And false 0 676 None 0 security log name Equal String None And false 0 security None bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons\Copy of NTLM Logon attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c7fa798b-24c9-43ae-87b5-e9653cf46ab2 Kerberos service ticket requests The section is based on event 673 (4769 - Vista/Longhorn) - A ticket granting service (TGS) ticket was requested. After a user's workstation requests a ticket-granting ticket (TGT), the workstation immediately requests a service ticket (TGS) so that the user can use the workstation. Windows 2003 domain records this event for both success and failure requests. The type field indicates weather the request was successful or not. In Windows 2000 domains, the event only records successful requests. For failed requests in Windows 2000 domains use the 677 event. Item false Computer monitored machine true false Type type true false User Name Fully Qualified User Name SpecialColumn true false Service Name service name true false Client Address client address true false Failure Code failure code true false Time time true false Date date true false 0 673 event id Equal Integer None Or false 1 673 None 0 4769 event id Equal Integer None Or false 0 4769 None 1 677 event id Equal Integer None And false 0 677 None 0 security log name Equal String None And false 0 security None bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons\Copy of Kerberos authentication ticket requests AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7d218e3e-76b1-44f0-8bf5-e9b598f86a7c Kerberos failed events The section is based on events 675 (4771 - Vista/Longhorn) - Pre-authentication failed, 676 (4772 - Vista/Longhorn) - AuthenticationTicket Request failed, and 677 (4773 - Vista/Longhorn) - Service ticket request failed. Event 675 is recorded both in Windows 2000 and Windows 2003 domains. In a Windows 2000 domain, events 676 and 677 are logged for failed authentication /service ticket request. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Service Name service name true false Client Address client address true false Failure Code failure code true false Time time true false Date date true false 0 675 event id Equal Integer None Or false 1 675 None 0 4771 event id Equal Integer None Or false 0 4771 None 0 676 event id Equal Integer None Or false 0 676 None 0 4772 event id Equal Integer None Or false 0 4772 None 0 677 event id Equal Integer None Or false 0 677 None 1 4773 event id Equal Integer None And false 0 4773 None 0 security log name Equal String None And false 0 security None bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons\Copy of Kerberos service ticket requests AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8e8de039-fc7b-4507-9e0b-6e981869b462 Terminal services account logon events This section is based on events 682 (4778 - Vista/Longhorn) and 683 (4779 - Vista/Longhorn) from the Account Logon category. The 682 event is recorded when a user has reconnected to a disconnected Terminal Services session. The 683 event is recorded when a user disconnected a Terminal Services session without logging off. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Session Name session name true false Client Name client name true false Client Address client address true false Date date true false Time time true false 0 682 event id Equal Integer None Or false 1 682 None 0 4778 event id Equal Integer None Or false 0 4778 None 0 683 event id Equal Integer None Or false 0 683 None 1 4779 event id Equal Integer None And false 0 4779 None 0 security log name Equal String None And false 0 security None bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons\Copy of Kerberos failed events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5b2a5c82-e2d1-464a-a78d-1d9e8f2d06d6 GCSx Code Of Connection Memo 22 SR7 - User Right Assignment Policy Changes The report is based on the 608(4704 - Vista/Longhorn) and 609(4705 - Vista/Longhorn) events. The event signals the fact that a new privilege was granted / removed to /for a user account. The event log records this action along with the user account Security Identifier (SID), not the user account name. In order to display the information in a more understandable manner, the privileges granted were translated to the associated policy name which was changed. For example, instead of SeTcbPrivilege, the report lists "Act as part of the operating system". Item false Account Modified assigned to 0 608 event id Equal Integer None And false 0 608 None removed from 0 609 event id Equal Integer None And false 0 609 None target SID 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None And false 0 4705 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privileges user right 0 608 event id Equal Integer None Or false 0 608 None 0 609 event id Equal Integer None Or false 0 609 None privilege list 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None Or false 0 4705 None true false Date date true false Time time true false 0 608 event id Equal Integer None Or false 1 608 None 0 609 event id Equal Integer None Or false 0 609 None 0 4704 event id Equal Integer None Or false 0 4704 None 1 4705 event id Equal Integer None And false 0 4705 None 0 security log name Equal String None And false 0 security None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:28.8625015+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of SOX 302.a.5 - User Rights Assignment Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 88e77dcb-e7f8-4a4d-a0e7-aa5e5c072db0 User Account Created The section is based on event 624(4720 - Vista/Longhorn). Only authorized people and processes should create network accounts. Examine the user performing the attempt field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. Item false User Creating The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Logon ID caller logon id true false New Account Name new account name 0 624 event id Equal Integer None And false 0 624 None target user name 0 4720 event id Equal Integer None And false 0 4720 None true false Date date true false Time time true false 0 624 event id Equal Integer None Or false 1 624 None 1 4720 event id Equal Integer None And false 0 4720 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2152b255-2990-4355-bbb7-a2c33444fc63 User Account Enabled The section is based on event 626(4722 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person enabling the accounts is authorized. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 626 event id Equal Integer None And false 0 626 None target user name 0 4722 event id Equal Integer None And false 0 4722 None true false Target Domain target domain 0 626 event id Equal Integer None And false 0 626 None target domain name 0 4722 event id Equal Integer None And false 0 4722 None true false Date date true false Time time true false 0 626 event id Equal Integer None Or false 1 626 None 1 4722 event id Equal Integer None And false 0 4722 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Enabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d33136e0-2ddd-4834-bc52-70fda54dea96 User Account Disabled The section is based on event 629(4725 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person disabling the accounts is authorized and that he or she verified the reasons why the accounts were disabled prior to enabling the accounts. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 629 event id Equal Integer None And false 0 629 None target user name 0 4725 event id Equal Integer None And false 0 4725 None true false Taget Domain target domain 0 629 event id Equal Integer None And false 0 629 None target domain name 0 4725 event id Equal Integer None And false 0 4725 None true false Date date true false Time time true false 0 629 event id Equal Integer None Or false 1 629 None 1 4725 event id Equal Integer None And false 0 4725 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Disabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e718c232-4b88-46f0-a7ae-34a68bad7bc9 User Account Unlocked The section is based on event 671(4767 - Vista/Longhorn) and lists all the accounts which were unlocked. Verify that the person unlocking the accounts is authorized and that he or she verified the reasons for the account lockouts prior to unlocking the accounts. Item false User Unlocking The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 671 event id Equal Integer None And false 0 671 None target user name 0 4767 event id Equal Integer None And false 0 4767 None true false Target Domain target domain 0 671 event id Equal Integer None And false 0 671 None target domain name 0 4767 event id Equal Integer None And false 0 4767 None true false Date date true false Time time true false 0 671 event id Equal Integer None Or false 1 671 None 1 4767 event id Equal Integer None And false 0 4767 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Unlocked AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 438a1648-7d11-4cfa-8ddb-b775eeadde63 User Account Renamed The section is based on event 685(4781 - Vista/Longhorn). Verify that the user performing the attempt corresponds to an authorized person or process. Item false User Renaming The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Old Account Name old account name 0 685 event id Equal Integer None And false 0 685 None old target user name 0 4781 event id Equal Integer None And false 0 4781 None true false New Account Name new target user name 0 4781 event id Equal Integer None And false 0 4781 None new account name 0 685 event id Equal Integer None And false 0 685 None true false Date date true false Time time true false 0 685 event id Equal Integer None Or false 1 685 None 1 4781 event id Equal Integer None And false 0 4781 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Renamed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ef89e068-d6e4-4616-b231-18c0406500e0 User Account Changed The section is based on event 642(4738 - Vista/Longhorn). This event records changes made to security-related properties of user accounts. Item false User Changing The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4738 event id Equal Integer None And false 0 4738 None true false Date date true false Time time true false 0 642 event id Equal Integer None Or false 1 642 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Changed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d7f780ff-0154-4fad-b3ad-065838b723dc Change Password Attempts The section shows password change attempts based on the 627(4723 - Vista/Longhorn) event. Compare the user trying to change the password with the Target Account Name to determine whether the account owner or someone else attempted to change the password. If the user trying to change the password does not equal the Target Account Name, someone other than the account owner tried to change the password. Check if the user trying to change the password is authorized to perform password changes.The failed attempts to change passwords are very important for security monitoring and may signal intruders trying to compromise user accounts. Therefore they are highlighted in light red in the report. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name true false Date date true false Time time true false 0 627 event id Equal Integer None Or false 1 627 None 1 4723 event id Equal Integer None And false 0 4723 None 0 security log name Equal String None And false 0 security None d2ac4b33-10f6-4382-ade5-d2c8d9fd401d true 2011-12-21T13:04:53.8813643+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Password Changes\Copy of Change Password Attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 07f268a0-f118-4724-b2c5-bcbcccc4bd75 User Account Password Set Or Reset The section, based on the 628(4724 - Vista/Longhorn) event, shows when a user or process resets an account password through an administrative interface such as Active Directory Users and Computers, rather than through a password change process. Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name 0 628 event id Equal Integer None And false 0 628 None target user name 0 4724 event id Equal Integer None And false 0 4724 None true false Date date true false Time time true false 0 628 event id Equal Integer None Or false 1 628 None 1 4724 event id Equal Integer None And false 0 4724 None 0 security log name Equal String None And false 0 security None d2ac4b33-10f6-4382-ade5-d2c8d9fd401d true 2011-12-21T13:04:53.8813643+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Password Changes\Copy of User Account Password Set Or Reset AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8ea5c110-342a-4f3d-a479-52f2dbf573c4 Changes To Dir. Services Restore Mode Password The section, based on the 698(4794 - Vista/Longhorn) event, shows when someone attempts to change the Directory Services Restore Mode password on a domain controller. Check Source Machine and the user performing the attempt and investigate immediately. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Source Machine monitored machine true false Date date true false Time time true false 0 698 event id Equal Integer None Or false 1 698 None 1 4794 event id Equal Integer None And false 0 4794 None 0 security log name Equal String None And false 0 security None d2ac4b33-10f6-4382-ade5-d2c8d9fd401d true 2011-12-21T13:04:53.8813643+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Password Changes\Copy of Changs To Dir. Services Restore Mode Password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3aa4d4ee-74dd-428c-8167-2332a1945d32 All Critical Windows Log Events The All critical Windows Log events is a report which allows viewing of the most important events from the Windows event logs that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:18:24.8098385+02:00 Daily 1 false false All Critical Messages\All Critical Windows Log Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 904f5551-add8-41ea-9d0f-06efbf60e097 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 3aa4d4ee-74dd-428c-8167-2332a1945d32 true 2011-12-21T12:18:24.8098385+02:00 Daily 1 false false All Critical Messages\All Critical Windows Log Events\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 585ca356-4646-4223-bf93-6d79f6c56b05 All Critical Windows Events A table showing all the events that correspond to the current filtering conditions. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Rule Name rule name true false Date date true false Time time true false 0 security log name Equal String None Or false 1 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 1 file replication log name Equal String None And false 0 file replication None 0 Critical importance Equal Integer None And false 0 4 None 3aa4d4ee-74dd-428c-8167-2332a1945d32 true 2011-12-21T12:18:24.8098385+02:00 Daily 1 false false All Critical Messages\All Critical Windows Log Events\Copy of All Critical Windows Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 30003a0c-5002-4221-84bd-be2ff542fbce All Critical Syslog Events The All critical Syslog events is a report which allows viewing of the most important events from Syslogs that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:18:40.6987473+02:00 Daily 1 false false All Critical Messages\All Critical Syslog Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2936f65d-1c90-4623-afc9-bcfa80e8ae5b Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 syslog log format Equal String None And false 0 syslog None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 30003a0c-5002-4221-84bd-be2ff542fbce true 2011-12-21T12:18:40.6987473+02:00 Daily 1 false false All Critical Messages\All Critical Syslog Events\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 448d30dc-2a6e-4d85-b33b-273565380f7a All Critical Syslog Events A table showing all the events that correspond to the current filtering conditions. Item false Computer monitored machine true true Message message true false Rule Name rule name true false Facility facility true false Severity severity true false Date date true false Time time true false 0 syslog log format Equal String None And false 0 syslog None 0 Critical importance Equal Integer None And false 0 4 None 30003a0c-5002-4221-84bd-be2ff542fbce true 2011-12-21T12:18:40.6987473+02:00 Daily 1 false false All Critical Messages\All Critical Syslog Events\Copy of All Critical Windows Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 078124dc-69ab-443f-882e-e0e426c22616 All Critical W3CELF Events on each Machine The All critical W3CELF events on each machine is a report which allows viewing of the most important events from the W3CELF logs that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:19:27.6174309+02:00 Daily 1 false false All Critical Messages\All Critical W3CELF Events on each Machine 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2604d757-bf72-4308-a402-540552bb4fa3 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 text log format Equal String None And false 0 text None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 078124dc-69ab-443f-882e-e0e426c22616 true 2011-12-21T12:19:27.6174309+02:00 Daily 1 false false All Critical Messages\All Critical W3CELF Events on each Machine\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 84a803de-06ef-4f6f-9393-40d0be31764f All Critical W3CELF Events A table showing all the events that correspond to the current filtering conditions. Item false Server Name s-computername true true Software software true false Client IP c-ip true false User Name Fully Qualified User Name SpecialColumn true false Method cs-method true false Returned Status sc-status true false Rule Name rule name true false Date date true false Time time true false 0 text log format Equal String None And false 0 text None 0 Critical importance Equal Integer None And false 0 4 None 078124dc-69ab-443f-882e-e0e426c22616 true 2011-12-21T12:19:27.6174309+02:00 Daily 1 false false All Critical Messages\All Critical W3CELF Events on each Machine\Copy of All Critical Syslog Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5d77ec96-0e11-496c-8683-8890448c5a34 All Critical Custom Log Events The All critical Custom Log events is a report which allows viewing of the most important events from the custom Windows event logs that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:19:45.889476+02:00 Daily 1 false false All Critical Messages\All Critical Custom Log Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fece3a90-51d0-4c48-9b6c-574bd324f4f0 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 custom logs log name Equal String None And false 0 custom logs None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 5d77ec96-0e11-496c-8683-8890448c5a34 true 2011-12-21T12:19:45.889476+02:00 Daily 1 false false All Critical Messages\All Critical Custom Log Events\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9ec776fe-726e-4ee8-bf5e-56fead91d57a All Critical Custom Log Events A table showing all the events that correspond to the current filtering conditions. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Rule Name rule name true false Log Name log name 0 custom logs log name Equal String None And true 0 custom logs None source 0 custom logs log name Equal String None And false 0 custom logs None true false Date date true false Time time true false 0 custom logs log name Equal String None And false 0 custom logs None 0 Critical importance Equal Integer None And false 0 4 None 5d77ec96-0e11-496c-8683-8890448c5a34 true 2011-12-21T12:19:45.889476+02:00 Daily 1 false false All Critical Messages\All Critical Custom Log Events\Copy of All Critical W3CELF Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1cbfc2a7-b4e9-4c83-9104-df4fab3e0efd All Critical SNMP Traps The All critical SNMP Traps is a report which allows viewing of the most important SNMP Traps that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:20:02.673436+02:00 Daily 1 false false All Critical Messages\All Critical SNMP Traps 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f6762092-88f5-4c69-9f15-a6334b82c7e2 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 snmp log format Equal String None And false 0 snmp None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 1cbfc2a7-b4e9-4c83-9104-df4fab3e0efd true 2011-12-21T12:20:02.673436+02:00 Daily 1 false false All Critical Messages\All Critical SNMP Traps\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e30645fe-aa84-43a2-8b61-967b8949ceed All Critical SNMP Traps A table showing all the events that correspond to the current filtering conditions. Item false Computer monitored machine true true Trap Data Trap Data SpecialColumn true false Trap OID trap oid true false Community String community string true false SNMP Version snmp version true false Rule Name rule name true false Date date true false Time time true false 0 snmp log format Equal String None And false 0 snmp None 0 Critical importance Equal Integer None And false 0 4 None 1cbfc2a7-b4e9-4c83-9104-df4fab3e0efd true 2011-12-21T12:20:02.673436+02:00 Daily 1 false false All Critical Messages\All Critical SNMP Traps\Copy of All Critical Custom Log Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1bbf7990-b032-4edb-91c8-24eba2e5b8aa All Critical Microsoft Sql Server Audit The All critical Microsoft Sql Server Audit is a report which allows viewing of the most important Microsoft Sql Server Audit events that need immediate attention. It also displays the top 10 rules that were triggered most frequently by these events. Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:20:24.8657053+02:00 Daily 1 false false All Critical Messages\All Critical Microsoft Sql Server Audit 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e4561a7b-2012-4db5-967b-f09aa531e6fc Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 sql log format Equal String None And false 0 sql None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 1bbf7990-b032-4edb-91c8-24eba2e5b8aa true 2011-12-21T12:20:24.8657053+02:00 Daily 1 false false All Critical Messages\All Critical Microsoft Sql Server Audit\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5139b828-c04a-4cd3-9109-1a0d0cf7ad63 All Critical Microsoft Sql Server Audit A table showing all the events that correspond to the current filtering conditions. Item false Server monitored machine true true Event Class event class true false Application Name application name true false Database Name database name true false Login Name login name true false Date date true false Time time true false Text Data text data true false 0 sql log format Equal String None And false 0 sql None 0 Critical importance Equal Integer None And false 0 4 None 1bbf7990-b032-4edb-91c8-24eba2e5b8aa true 2011-12-21T12:20:24.8657053+02:00 Daily 1 false false All Critical Messages\All Critical Microsoft Sql Server Audit\Copy of All Critical SNMP Traps AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 948eddf8-196b-4372-b706-03b015e33024 Event Log Health The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Container false 9d2cd0a2-17dd-45be-9c8c-554d321899cb true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3cab4176-7ade-48d2-b279-c240b86041d6 Event Log Full The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 6000 event id Equal Integer None And false 0 6000 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of m Event Log Health AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 51d33625-4cfe-4ae2-9613-c0d1af8dcf98 Event Log Service Stopped The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 6006 event id Equal Integer None And false 0 6006 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 26031b8c-fb4e-4918-baa7-bdb3e4ca8732 Event Log Service Started The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 6005 event id Equal Integer None And false 0 6005 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b174d041-53b5-44d3-826f-5833becf9c45 Log File Corrupt The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 6002 event id Equal Integer None And false 0 6002 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a9549239-0ca3-4dcd-900f-28fa207b616e Unexpected System Shutdown The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 6008 event id Equal Integer None And false 0 6008 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f648e3b5-aef1-47e9-bd67-2476489d7d0f Vista/Longhorn - Security EventLog Events The report is based on important events in the system log, with source EventLog. It displays events like log full, log file corrupt, Event Log service stopping /starting, and unexpected system shutdowns. Use this report to determine failures in the auditing process. These failures may be exploited by attackers and usually lead to loss of audit entries.In Windows Vista/Longhorn events related to the security log are also written in security log. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1100 event id Equal Integer None Or false 1 1100 None 0 1101 event id Equal Integer None Or false 0 1101 None 0 1102 event id GreaterThan Integer None And false 1 1102 None 2 1109 event id LessThan Integer None And false 0 1109 None 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 948eddf8-196b-4372-b706-03b015e33024 true 2011-12-21T12:17:16.3049203+02:00 Daily 1 false false Windows Event Log System\Event Log Health\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4e68d9f4-d38b-4c6b-87bf-db77e6e536a2 Event Log Service Errors The report is based on the events with type error in the system log with source EventLog. They signal errors in the auditing process. Investigate the problems as soon as possible. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 EventLog source Equal String None And false 0 EventLog None 0 system log name Equal String None And false 0 system None 0 Error type Equal Integer None And false 0 1 None 9d2cd0a2-17dd-45be-9c8c-554d321899cb true 2011-12-21T12:17:35.5800228+02:00 Daily 1 false false Windows Event Log System\Copy of Event Log Full AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 dc31038c-f3cd-4d54-bcc3-b0ff8156c27e Applications Installed/Removed The report is based on the events in the application log with source "MsiInstaller". It displays the applications successfully installed/uninstalled using Windows Installer technology, and failed attempts to install or uninstall such applications. Container false da5506fc-63d1-4bfe-a897-06202b907165 true 2011-12-21T12:16:28.1691671+02:00 Daily 1 false false Application Management\Applications Installed/Removed 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e6319a53-c121-4d11-bb72-cbea95ad93c5 Applications Crashing or Hanging The report is based on the events in the application log with sources "Application Error", "Application Hang" and "DrWatson". The report displays all the applications which crashed or hanged, together with the associated information. Container false da5506fc-63d1-4bfe-a897-06202b907165 true 2011-12-21T12:16:43.4280398+02:00 Daily 1 false false Application Management\Applications Crashing or Hanging 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a89f85f8-1fad-4fb3-b719-ae4107705e33 Applications Successfully Installed A table showing successful application install events. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description field 00 true false Event ID event id true false Source source true false Date date true false Time time true false 0 11707 event id Equal Integer None And false 0 11707 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None dc31038c-f3cd-4d54-bcc3-b0ff8156c27e true 2011-12-21T12:16:28.1691671+02:00 Daily 1 false false Application Management\Applications Installed/Removed\Copy of Applications Successfully Installed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 97db6b49-2854-4409-9e2b-b3ac98e8d673 Applications Successfully Uninstalled A table showing successful application uninstall events. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11724 event id Equal Integer None And false 0 11724 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None dc31038c-f3cd-4d54-bcc3-b0ff8156c27e true 2011-12-21T12:16:28.1691671+02:00 Daily 1 false false Application Management\Applications Installed/Removed\Copy of Applications Successfully Uninstalled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1c9402a9-f58d-4ab3-abf7-dc099b5bd003 Applications Which Failed To Install A table showing failed application install events. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11708 event id Equal Integer None And false 0 11708 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None dc31038c-f3cd-4d54-bcc3-b0ff8156c27e true 2011-12-21T12:16:28.1691671+02:00 Daily 1 false false Application Management\Applications Installed/Removed\Copy of Applications Which Failed To Install AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 87976cd7-978f-48ea-822c-b45c10f12300 Applications Which Failed To Uninstall A table showing failed application uninstall events. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 11725 event id Equal Integer None And false 0 11725 None 0 application log name Equal String None And false 0 application None 0 MsiInstaller source Equal String None And false 0 MsiInstaller None dc31038c-f3cd-4d54-bcc3-b0ff8156c27e true 2011-12-21T12:16:28.1691671+02:00 Daily 1 false false Application Management\Applications Installed/Removed\Copy of Applications Which Failed To Uninstall AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 498b5b4b-8fb3-4217-8712-ca0d41fb0ea6 Applications Which Crashed A table showing details of applications which crashed. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1000 event id Equal Integer None Or false 1 1000 None 0 1004 event id Equal Integer None Or false 0 1004 None 1 1005 event id Equal Integer None And false 0 1005 None 0 application log name Equal String None And false 0 application None 0 Application Error source Equal String None And false 0 Application Error None e6319a53-c121-4d11-bb72-cbea95ad93c5 true 2011-12-21T12:16:43.4280398+02:00 Daily 1 false false Application Management\Applications Crashing or Hanging\Copy of Applications Which Crashed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 50699706-bbcb-4c40-8e57-63c91671355f Applications Which Hanged A table showing applications which hanged. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 1002 event id Equal Integer None And false 0 1002 None 0 application log name Equal String None And false 0 application None 0 Application Hang source Equal String None And false 0 Application Hang None e6319a53-c121-4d11-bb72-cbea95ad93c5 true 2011-12-21T12:16:43.4280398+02:00 Daily 1 false false Application Management\Applications Crashing or Hanging\Copy of Applications Which Hanged AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ea6ea7e6-c636-4862-a99d-2ff6a967385b DrWatson Events A table showing events generated by DrWatson. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Description Description SpecialColumn true false Event ID event id true false Source source true false Date date true false Time time true false 0 4097 event id Equal Integer None And false 0 4097 None 0 application log name Equal String None And false 0 application None 0 DrWatson source Equal String None And false 0 DrWatson None e6319a53-c121-4d11-bb72-cbea95ad93c5 true 2011-12-21T12:16:43.4280398+02:00 Daily 1 false false Application Management\Applications Crashing or Hanging\Copy of DrWatson Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 56baca85-95d4-4932-b4a5-b70272083e00 Failed Attempts to Access Files and Registry The report is based on event 560(4656 - Vista/Longhorn) with type failure audit. These events show when an object has rejected access to a request, such as list, read, create, and delete. The report shows failed attempts to access files or registry and does not include normal system activity. Note that for best results, file auditing is required to be enabled on the files and registry values of interest. Use the report to identify users who are trying to access resources they are not granted access to. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Failure Audit type Equal Integer None And false 0 16 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 5d3525a4-f9e4-4ce0-b41e-c916ab3d5ee8 true 2011-12-21T12:16:17.1735382+02:00 Daily 1 false false Object Access\Copy of GCSx Code Of Connection Memo 22 - Failed Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b5094811-83c2-4a08-90d8-34f3e862cd54 Successful Attempts to Access Files and Registry The report will list all the successful attempts to access files and registry based on the object access events. The report will help you identify users or applications attempting successfuly accessing files and registry that are security sensitive. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Object Name object name true false Object Type object type true false Date date true false Time time true false 0 560 event id Equal Integer None Or false 1 560 None 1 4656 event id Equal Integer None And false 0 4656 None 0 security log name Equal String None And false 0 security None 0 Success Audit type Equal Integer None And false 0 8 None 0 Key object type Equal String None Or false 1 Key None 1 File object type Equal String None And false 0 File None 5d3525a4-f9e4-4ce0-b41e-c916ab3d5ee8 true 2011-12-21T12:16:20.0857047+02:00 Daily 1 false false Object Access\Copy of GCSx Code Of Connection Memo 22 - Successful Attempts to Access Files and Registry AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0a7c79aa-1e3e-4f7f-93b7-23d88f2710a4 Local Audit Policy Changes The report is based on the 612(4719 - Vista/Longhorn) event - local audit policy changed. The event identifies any change to audit policy. Correlate this event with changes that authorized personnel make to audit policy. Item false Computer name monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy Change privilege use 0 612 event id Equal Integer None And false 0 612 None category id 0 4719 event id Equal Integer None And false 0 4719 None true false Date date true false Time time true false 0 612 event id Equal Integer None Or false 1 612 None 1 4719 event id Equal Integer None And false 0 4719 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:46.8978065+02:00 Daily 1 false false Policy Changes\Copy of SOX 302.a.5 - Local Audit Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ba80ee86-d766-47b4-a002-611a6da76d4a User Rights Assignment Policy Changes The report is based on the 608(4704 - Vista/Longhorn) and 609(4705 - Vista/Longhorn) events. The event signals the fact that a new privilege was granted / removed to /for a user account. The event log records this action along with the user account Security Identifier (SID), not the user account name. In order to display the information in a more understandable manner, the privileges granted were translated to the associated policy name which was changed. For example, instead of SeTcbPrivilege, the report lists "Act as part of the operating system". Item false Computer monitored machine true true Account Modified assigned to 0 608 event id Equal Integer None And false 0 608 None removed from 0 609 event id Equal Integer None And false 0 609 None target SID 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None And false 0 4705 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privileges user right 0 608 event id Equal Integer None Or false 0 608 None 0 609 event id Equal Integer None Or false 0 609 None privilege list 0 4704 event id Equal Integer None Or false 0 4704 None 0 4705 event id Equal Integer None Or false 0 4705 None true false Date date true false Time time true false 0 608 event id Equal Integer None Or false 1 608 None 0 609 event id Equal Integer None Or false 0 609 None 0 4704 event id Equal Integer None Or false 0 4704 None 1 4705 event id Equal Integer None And false 0 4705 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:49.563959+02:00 Daily 1 false false Policy Changes\Copy of SOX 302.a.5 - User Rights Assignment Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1e7313c3-f1be-487e-9107-d7a8810f9d34 System Access Granted/Removed The report is based on the 621 (4717 - Vista /Longhorn) and 622(4718 - Vista/Longhorn) events. The events signal the fact that a user was granted access to a system or user system access was removed. Check User Name and Account Modified, particularly if access permission is interactive. Event 622 might indicate that an attacker removed evidence of event 621 (system access granted to user account) in order to cover the trails, or is attempting to deny service to some other account(s). Item false Computer monitored machine true true Account Modified account modified 0 621 event id Equal Integer None Or false 0 621 None 0 622 event id Equal Integer None Or false 0 622 None target sid 0 4717 event id Equal Integer None Or false 0 4717 None 0 4718 event id Equal Integer None Or false 0 4718 None true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Privilege access granted 0 621 event id Equal Integer None Or false 0 621 None 0 4717 event id Equal Integer None Or false 0 4717 None access removed 0 622 event id Equal Integer None Or false 0 622 None 0 4718 event id Equal Integer None Or false 0 4718 None true false Date date true false Time time true false 0 621 event id Equal Integer None Or false 1 621 None 0 622 event id Equal Integer None Or false 0 622 None 0 4717 event id Equal Integer None Or false 0 4717 None 1 4718 event id Equal Integer None And false 0 4718 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:51.924094+02:00 Daily 1 false false Policy Changes\Copy of GCSx Code Of Connection Memo 22 SR7 - System Access Granted/Removed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6e4adb07-61c0-421c-9b0c-871838653dba IPSec Policy Changes This report is based on events 613(4709 - Vista/Longhorn), 614(4710 - Vista/Longhorn) and 615(4711 - Vista/Longhorn). Monitor these events and investigate any occurrences that are outside system startups. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Date date true false Time time true false 0 613 event id Equal Integer None Or false 1 613 None 0 614 event id Equal Integer None Or false 0 614 None 0 615 event id Equal Integer None Or false 0 615 None 0 4709 event id Equal Integer None Or false 0 4709 None 0 4710 event id Equal Integer None Or false 0 4710 None 1 4711 event id Equal Integer None And false 0 4711 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:53.8012013+02:00 Daily 1 false false Policy Changes\Copy of GCSx Code of Connection Memo 22 SR7 - IPSec Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0e5f0360-6fcb-4455-8cf5-5f95d99e6c0f Kerberos Policy Changes This section is based on event 617(4713 - Vista/Longhorn). The event signals a Kerberos policy change. Verify if the user performing the change is authorized and if the change occurs according to your security policies/plans. Item false UserName Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Description Description SpecialColumn true false Date date true false Time time true false Computer monitored machine true true 0 617 event id Equal Integer None Or false 1 617 None 1 4713 event id Equal Integer None And false 0 4713 None 0 security log name Equal String None And false 0 security None 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:15:55.9693253+02:00 Daily 1 false false Policy Changes\Copy of GCSx Code of Connection Memo 22 SR7 - Kerberos Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b3d8432f-64bb-438f-abee-7547003c31a6 User Account Management The report will help you achieve the following goals: Find irregular or unusual network account activities, identify administrators who abuse privileges to create or modify accounts and detect patterns of account activities that breach organizational security policies. Container false bdd0f004-5f0d-4681-8a7c-6009a85b1f1e true 2011-12-21T12:15:37.3932629+02:00 Daily 1 false false Account Management\User Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 516fc515-3df2-45e5-8998-5dd7dc50ba7f User Account Created The section is based on event 624(4720 - Vista/Longhorn). Only authorized people and processes should create network accounts. Examine the user performing the attempt field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. Item false User Creating The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Logon ID caller logon id true false New Account Name new account name 0 624 event id Equal Integer None And false 0 624 None target user name 0 4720 event id Equal Integer None And false 0 4720 None true false Date date true false Time time true false 0 624 event id Equal Integer None Or false 2 624 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:20.1478447+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f56e0b93-9c52-48fc-8cbb-d77ad991d3e0 User Account Enabled The section is based on event 626(4722 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person enabling the accounts is authorized. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 626 event id Equal Integer None And false 0 626 None target user name 0 4722 event id Equal Integer None And false 0 4722 None true false Target Domain target domain 0 626 event id Equal Integer None And false 0 626 None target domain name 0 4722 event id Equal Integer None And false 0 4722 None true false Date date true false Time time true false 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:23.2420217+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Enabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3d4b9c9c-677c-47af-82e2-502d8ea1c15f User Account Disabled The section is based on event 629(4725 - Vista/Longhorn) and lists all the accounts which were disabled. Verify that the person disabling the accounts is authorized and that he or she verified the reasons why the accounts were disabled prior to enabling the accounts. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 629 event id Equal Integer None And false 0 629 None target user name 0 4725 event id Equal Integer None And false 0 4725 None true false Taget Domain target domain 0 629 event id Equal Integer None And false 0 629 None target domain name 0 4725 event id Equal Integer None And false 0 4725 None true false Date date true false Time time true false 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:25.9241751+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Disabled AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c05c4aad-6f10-4eba-9b16-3f42733149c3 User Account Deleted The section is based on event 630(4726 - Vista/Longhorn). Only authorized people and processes should delete network accounts. Search for these events and examine the user performing the attempt field to detect if unauthorized people have deleted accounts. Item false User Deleting The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 630 event id Equal Integer None And false 0 630 None target user name 0 4726 event id Equal Integer None And false 0 4726 None true false Target Domain target domain 0 630 event id Equal Integer None And false 0 630 None target domain name 0 4726 event id Equal Integer None And false 0 4726 None true false Date date true false Time time true false 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:28.8663433+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d8534809-c7ea-4276-90ea-3440a9484b0b User Account Unlocked The section is based on event 671(4767 - Vista/Longhorn) and lists all the accounts which were unlocked. Verify that the person unlocking the accounts is authorized and that he or she verified the reasons for the account lockouts prior to unlocking the accounts. Item false User Unlocking The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 671 event id Equal Integer None And false 0 671 None target user name 0 4767 event id Equal Integer None And false 0 4767 None true false Target Domain target domain 0 671 event id Equal Integer None And false 0 671 None target domain name 0 4767 event id Equal Integer None And false 0 4767 None true false Date date true false Time time true false 0 671 event id Equal Integer None Or false 1 671 None 1 4767 event id Equal Integer None And false 0 4767 None 0 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:31.1464738+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Unlocked AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8ce8647c-3a1a-48eb-91b8-73c57447b9bc User Account Renamed The section is based on event 685(4781 - Vista/Longhorn). Verify that the user performing the attempt corresponds to an authorized person or process. Item false User Renaming The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Old Account Name old account name 0 685 event id Equal Integer None And false 0 685 None old target user name 0 4781 event id Equal Integer None And false 0 4781 None true false New Account Name new target user name 0 4781 event id Equal Integer None And false 0 4781 None new account name 0 685 event id Equal Integer None And false 0 685 None true false Date date true false Time time true false 0 685 event id Equal Integer None Or false 1 685 None 1 4781 event id Equal Integer None And false 0 4781 None 0 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:33.4316045+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Renamed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d1699508-17bc-4cb8-8200-f37ea54c92b9 User Account Operations Distribution A chart that displays the distributions of the user account operations. Item false Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 642 event id Equal Integer None Or false 1 642 None 0 624 event id Equal Integer None Or false 0 624 None 0 4720 event id Equal Integer None Or false 0 4720 None 0 626 event id Equal Integer None Or false 0 626 None 0 4722 event id Equal Integer None Or false 0 4722 None 0 629 event id Equal Integer None Or false 0 629 None 0 4725 event id Equal Integer None Or false 0 4725 None 0 4726 event id Equal Integer None Or false 0 4726 None 0 630 event id Equal Integer None Or false 0 630 None 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None Top Pie Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false Event ID event id false false Chart data false None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:36.186762+02:00 Daily 1 false false Account Management\User Account Management\Copy of User account operations distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a08bcad7-8fe2-4fec-a8cf-610eff781c96 User Account Changed The section is based on event 642(4738 - Vista/Longhorn). This event records changes made to security-related properties of user accounts. Item false User Changing The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 642 event id Equal Integer None And false 0 642 None target user name 0 4738 event id Equal Integer None And false 0 4738 None true false Target Domain target domain 0 642 event id Equal Integer None And false 0 642 None target domain name 0 4738 event id Equal Integer None And false 0 4738 None true false Date date true false Time time true false 0 642 event id Equal Integer None Or false 1 642 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None b3d8432f-64bb-438f-abee-7547003c31a6 true 2011-12-21T12:14:39.0129237+02:00 Daily 1 false false Account Management\User Account Management\Copy of User Account Changed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 60de0ee0-9510-4c76-8c76-79d186aa4411 Password Changes Password resets should occur within an approved framework only. Properly configured security audit levels should record password resets in the security event logs and identify those resets that do not follow the correct procedures. The report may contain the following sections: "Change password attempts", "User account password set or reset" and "Changes to directory service restore mode passwords". Container false bdd0f004-5f0d-4681-8a7c-6009a85b1f1e true 2011-12-21T12:15:31.328916+02:00 Daily 1 false false Account Management\Password Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8c0c820b-d1a9-4a41-b87c-b9dde7154ef4 Change Password Attempts The section shows password change attempts based on the 627(4723 - Vista/Longhorn) event. Compare the user trying to change the password with the Target Account Name to determine whether the account owner or someone else attempted to change the password. If the user trying to change the password does not equal the Target Account Name, someone other than the account owner tried to change the password. Check if the user trying to change the password is authorized to perform password changes.The failed attempts to change passwords are very important for security monitoring and may signal intruders trying to compromise user accounts. Therefore they are highlighted in light red in the report. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name true false Date date true false Time time true false 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None 60de0ee0-9510-4c76-8c76-79d186aa4411 true 2012-04-26T17:14:30.0878906+03:00 Daily 1 false false Account Management\Password Changes \Copy of Change Password Attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5d755f44-835d-4b4e-8a59-a5093642386f User Account Password Set Or Reset The section, based on the 628(4724 - Vista/Longhorn) event, shows when a user or process resets an account password through an administrative interface such as Active Directory Users and Computers, rather than through a password change process. Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Target Account target account name 0 628 event id Equal Integer None And false 0 628 None target user name 0 4724 event id Equal Integer None And false 0 4724 None true false Date date true false Time time true false 0 628 event id Equal Integer None Or false 1 628 None 1 4724 event id Equal Integer None And false 0 4724 None 0 security log name Equal String None Or false 0 security None 60de0ee0-9510-4c76-8c76-79d186aa4411 true 2011-12-21T12:14:45.2842824+02:00 Daily 1 false false Account Management\Password Changes \Copy of User Account Password Set Or Reset AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 305cacd3-d899-44f1-828e-54183cd837ec Changes To Dir. Services Restore Mode Password The section, based on the 698(4794 - Vista/Longhorn) event, shows when someone attempts to change the Directory Services Restore Mode password on a domain controller. Check Source Machine and the user performing the attempt and investigate immediately. Item false User Trying To Change The Password Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Type type true false Source Machine monitored machine true false Date date true false Time time true false 0 698 event id Equal Integer None Or false 1 698 None 1 4794 event id Equal Integer None And false 0 4794 None 0 security log name Equal String None And false 0 security None 60de0ee0-9510-4c76-8c76-79d186aa4411 true 2011-12-21T12:14:47.7334225+02:00 Daily 1 false false Account Management\Password Changes \Copy of Changs To Dir. Services Restore Mode Password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e057d886-5b09-41b1-916e-47f2e4c1554c Security Group Management Good security practice advocates the principle of least privilege, which translates into giving users the minimum rights and permissions they need to do their jobs. Most user accounts should be members of the Domain Users group only, together with any organization-specific security groups. Placement of users into security groups, particularly users who have high privileges such as Domain, Schema, or Enterprise Admins, should occur within policy guidelines only, and should make use of established and approved accounts or processes. You should treat any other changes as suspicious and investigate further. Container false bdd0f004-5f0d-4681-8a7c-6009a85b1f1e true 2011-12-21T12:15:24.3455166+02:00 Daily 1 false false Account Management\Security Group Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3a3ebce3-2619-4c0a-831e-382aa294fe62 Security Enabled Global Group Changes The section is based on events from 631 to 634 (4727 to 4730 - Vista/Longhorn) , and 641(4737 - Vista/Longhorn) events. Examine this section for groups that have global or broad access privileges, such as the Domain Admins group, to ensure that no changes occur outside organizational policy constraints. Item false User Perfoming Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None e057d886-5b09-41b1-916e-47f2e4c1554c true 2011-12-21T12:14:54.3478008+02:00 Daily 1 false false Account Management\Security Group Management\Copy of Security Enabled Global Group changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 11ef9193-f0c3-447f-969b-19e331b7d1cd Security Enabled Local Group Changes The section is based on events from 635 to 639(4731 to 4735 - Vista/Longhorn). Examine this section for groups such as Administrators, Server Operators, and Backup Operators to ensure that no changes take place outside of policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None e057d886-5b09-41b1-916e-47f2e4c1554c true 2011-12-21T12:14:57.1549614+02:00 Daily 1 false false Account Management\Security Group Management\Copy of Security Enabled Local Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 30ba47b8-312f-4ad1-b931-8fb9b6040d29 Security Enabled Universal Group Changes The section is based on events from 659 to 662(4755 to 4758 - Vista/Longhorn). Examine for groups that have high privilege levels, such as Enterprise Admins or Schema Admins, to ensure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name 0 632 event id GreaterThan Integer None And false 1 632 None 1 638 event id Equal Integer None Or false 0 638 None 0 659 event id GreaterThan Integer None And false 1 659 None 1 662 event id LessThan Integer None Or false 0 662 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None new account name 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None target user name 0 4727 event id GreaterThan Integer None And false 1 4727 None 1 4735 event id LessThan Integer None Or false 0 4735 None 0 4755 event id GreaterThan Integer None And false 1 4755 None 1 4758 event id LessThan Integer None Or false 0 4758 None 0 4737 event id Equal Integer None Or false 0 4737 None 0 4764 event id Equal Integer None Or false 0 4764 None true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None e057d886-5b09-41b1-916e-47f2e4c1554c true 2011-12-21T12:15:00.0361262+02:00 Daily 1 false false Account Management\Security Group Management\Copy of Security Enabled Universal Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 914da129-8825-46e1-b1b9-cc22075df803 Security Enabled Group Type Changes The section is based on the 668(4764 - Vista/Longhorn) event. It indicates changes to the group type. You should examine these events for groups that have high privilege levels to make sure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Date date true false Time time true false 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None e057d886-5b09-41b1-916e-47f2e4c1554c true 2011-12-21T12:15:02.4762657+02:00 Daily 1 false false Account Management\Security Group Management\Copy of Security Enabled Group Type Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 28db51f4-174b-473c-bfd1-65af991f9444 Computer Account Management Every computer running Windows NT, Windows 2000, Windows XP, Windows Vista or a server running Windows Server 2003 or Windows Longhorn that joins a domain has an associated computer account. The events in this report provide the necessary auditing of computer access to the network and to domain resources as well as information about the computers domain membership. Container false bdd0f004-5f0d-4681-8a7c-6009a85b1f1e true 2011-12-21T12:15:20.9873245+02:00 Daily 1 false false Account Management\Computer Account Management 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 66871c77-209f-4c4c-b9ee-d8a29ffc414f Computer Account Management Operations Distribution A chart that displays the distributions of the computer account operations. Item false Operation Account created FixedValue 0 645 event id Equal Integer None Or false 1 645 None 1 4741 event id Equal Integer None Or false 0 4741 None Account changed FixedValue 0 646 event id Equal Integer None Or false 2 646 None 1 4742 event id Equal Integer None And false 0 4742 None 1 security log name Equal String None Or false 0 security None Account deleted FixedValue 0 647 event id Equal Integer None Or false 2 647 None 1 4743 event id Equal Integer None And false 0 4743 None 1 security log name Equal String None Or false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 645 event id Equal Integer None Or false 1 645 None 1 4741 event id Equal Integer None Or false 0 4741 None 0 646 event id Equal Integer None Or false 2 646 None 1 4742 event id Equal Integer None And false 0 4742 None 1 security log name Equal String None Or false 0 security None 0 647 event id Equal Integer None Or false 2 647 None 1 4743 event id Equal Integer None And false 0 4743 None 1 security log name Equal String None Or false 0 security None Top Pie Operation Account created FixedValue 0 645 event id Equal Integer None Or false 1 645 None 1 4741 event id Equal Integer None Or false 0 4741 None Account changed FixedValue 0 646 event id Equal Integer None Or false 2 646 None 1 4742 event id Equal Integer None And false 0 4742 None 1 security log name Equal String None Or false 0 security None Account deleted FixedValue 0 647 event id Equal Integer None Or false 2 647 None 1 4743 event id Equal Integer None And false 0 4743 None 1 security log name Equal String None Or false 0 security None true false Event ID event id false false Chart data false None 28db51f4-174b-473c-bfd1-65af991f9444 true 2011-12-21T12:15:10.1247032+02:00 Daily 1 false false Account Management\Computer Account Management\Computer account management operations distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 65d76a83-d14d-42a5-9a1b-6f179980b0df Computer Account Created The report shows the computer accounts which were created. The report is based on the “computer account created” event which usually signals the fact that a computer has joined a domain Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Account Created User Managing Accounts SpecialColumn true false Caller Account Fully Qualified User Name SpecialColumn true false Date date true false Time time true false 0 645 event id Equal Integer None Or false 1 645 None 1 4741 event id Equal Integer None And false 0 4741 None 0 security log name Equal String None And false 0 security None 28db51f4-174b-473c-bfd1-65af991f9444 true 2011-12-21T12:15:12.6688487+02:00 Daily 1 false false Account Management\Computer Account Management\Computer account created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 304ce5d5-10f5-4873-a666-0d0d0d887511 Computer Account Changed The report shows the changes performed on the computer accounts. The report is based on the “computer account changed” event which shows changes performed by the administrator on the computer accounts. These include resetting the account, enabling/disabling the account, etc. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Account Changed User Managing Accounts SpecialColumn true false Caller Account Fully Qualified User Name SpecialColumn true false Date date true false Time time true false 0 646 event id Equal Integer None Or false 2 646 None 1 4742 event id Equal Integer None And false 0 4742 None 1 security log name Equal String None Or false 0 security None 28db51f4-174b-473c-bfd1-65af991f9444 true 2011-12-21T12:15:14.8369727+02:00 Daily 1 false false Account Management\Computer Account Management\Copy of Computer Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 eaba14e1-1f2c-415c-9dad-43b1b772080b Computer Account Deleted The report shows the computer accounts which were deleted. The report is based on the “ computer account deleted” events which usually signal the fact that a computer was removed from a domain. Item false User Name Fully Qualified User Name SpecialColumn true false Computer monitored machine true false Account Deleted User Managing Accounts SpecialColumn true false Caller Account Fully Qualified User Name SpecialColumn true false Date date true false Time time true false 0 647 event id Equal Integer None Or false 1 647 None 1 4743 event id Equal Integer None And false 0 4743 None 0 security log name Equal String None Or false 0 security None 28db51f4-174b-473c-bfd1-65af991f9444 true 2011-12-21T12:15:17.2071083+02:00 Daily 1 false false Account Management\Computer Account Management\Copy of Computer Account Created AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c05fd2d4-75e4-4bdb-b4f6-b0d3dd418aa7 SOX 302.a.5 - Domain Policy Changes The report shows the changes to the domain policy of the computers being monitored by EventsManager. Container false d73c7313-ed40-49ae-b591-3da197e02ad6 true 1800-01-01T00:00:00 None false SOX Compliance\SOX 302.a.5 - Domain Policy Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 caec8330-dee2-48c6-bf6a-f990df33e254 Domain Policy Changes The report shows the changes to the domain policy of the computers being monitored by EventsManager. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None c05fd2d4-75e4-4bdb-b4f6-b0d3dd418aa7 true 2012-01-20T17:51:47.7867486+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Domain Policy Changes\Copy of SOX 302.a.5 - Domain Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 14f4ab0d-58ec-481d-a5ba-71c65083f894 Domain Policy Change Distributions On All Computers The report shows the changes to the domain policy of the computers being monitored by EventsManager. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy domain policy changed true false Computer monitored machine true true Query data false None c05fd2d4-75e4-4bdb-b4f6-b0d3dd418aa7 true 2012-01-20T17:51:50.362896+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Domain Policy Changes\Copy of SOX 302.a.5 - Domain Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1cfb7474-0d93-42ab-8c8c-807a3624fad1 Security Enabled Group Changes Distribution A pie chart showing the distribution of the security group changes. Item false Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 630 event id GreaterThan Integer None And false 2 630 None 1 640 event id LessThan Integer None Or false 0 640 None 0 658 event id GreaterThan Integer None And false 1 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4736 event id LessThan Integer None Or false 0 4736 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 1 4759 event id LessThan Integer None Or false 0 4759 None 0 4737 event id Equal Integer None Or false 0 4737 None 1 4764 event id Equal Integer None And false 0 4764 None 0 security log name Equal String None And false 0 security None Top Pie Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None e057d886-5b09-41b1-916e-47f2e4c1554c true 2011-12-21T12:15:04.5653852+02:00 Daily 1 false false Account Management\Security Group Management\Copy of Security Enabled Group Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 228c9db3-2525-4d9d-8d4c-6b3b9248d7b0 GCSx Code Of Connection Memo 22 - Failed Logons Count on each Computer This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true true Description And EventID Description And EventID SpecialColumn true false Logon Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id GreaterThan Integer None And false 2 528 None 1 538 event id LessThan Integer None Or false 0 538 None 0 539 event id Equal Integer None Or false 0 539 None 0 548 event id Equal Integer None Or false 0 548 None 0 549 event id Equal Integer None Or false 0 549 None 1 4625 event id Equal Integer None And false 0 4625 None 0 security log name Equal String None And false 0 security None Top Bars Description And EventID Description And EventID SpecialColumn true false Event ID event id false false Chart data false None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:31.7456664+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of Failed Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6772ba72-3992-4da9-a469-fd71b3de8e6b GCSx Code Of Connection Memo 22 - Successful Logon Count on each Computer This report lists the number of failed logons on each computer, as well as the type of failure, helping you identify which are the computers showing suspect access attempts. Item false Computer monitored machine true true User name Fully Qualified User Name SpecialColumn true false Logon count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 528 event id Equal Integer None Or false 1 528 None 0 540 event id Equal Integer None Or false 0 540 None 0 4624 event id Equal Integer None Or false 0 4624 None 1 4636 event id Equal Integer None And false 0 4636 None 0 security log name Equal String None And false 0 security None Top Bars User name Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data false None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:34.2168078+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of Successful Logon Count on each Computer AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7c8fff9f-ea7a-4871-b6e4-f6fbcebb1318 SharePoint - Custom Audit SharePoint auditing allows application developers to log custom events to the audit log. LOGbinder SP records these events as event ID 18. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Event ID event id true false Search field 03 true false 0 18 event id Equal Integer None And false 1 18 None 0 LOGbndSP source Equal String None And false 0 LOGbndSP None 1 custom logs log name Equal String None Or false 0 custom logs None 0 18 event id Equal Integer None And false 1 18 None 0 LOGbndSC source Equal String None And false 0 LOGbndSC None 1 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:16.3516849+02:00 Daily 1 false false SharePoint\Copy of SharePoint - Search AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bbf798b5-9d1f-4d98-aebd-898c0f60c69f SharePoint - Audit NOISE LOGbinder SP detects certain events from SharePoint auditing as noise events as misleading or irrelevant and optionally logs them as event ID 10 as configured in the LOGbinder SP agent configuration. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Event ID event id true false Search field 03 true false 0 10 event id Equal Integer None And false 1 10 None 0 LOGbndSP source Equal String None And false 0 LOGbndSP None 1 custom logs log name Equal String None Or false 0 custom logs None 0 10 event id Equal Integer None And false 1 10 None 0 LOGbndSC source Equal String None And false 0 LOGbndSC None 1 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:18.4958076+02:00 Daily 1 false false SharePoint\Copy of SharePoint - Search AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4c4d49e2-288c-4d77-8c95-d1c62c76d754 SharePoint - View Events This report lists view events for document libraries (event ID 48), documents (event ID 47), lists (event ID 49) and other objects (event ID 50). LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Object Share Point Object SpecialColumn true false 0 46 event id GreaterThan Integer None And false 2 46 None 1 51 event id LessThan Integer None And false 0 51 None 0 LOGbndSP source Equal String None And false 0 LOGbndSP None 1 custom logs log name Equal String None Or false 0 custom logs None 0 46 event id GreaterThan Integer None And false 2 46 None 1 51 event id LessThan Integer None And false 0 51 None 0 LOGbndSC source Equal String None And false 0 LOGbndSC None 1 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:20.7129344+02:00 Daily 1 false false SharePoint\Copy of SharePoint - Search AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6717480b-e85d-47fa-bd25-d0967bbb6cbe SharePoint - Document Update This report lists document level access events except for view events. To limit the report to specific document operations filter by event ID: 13 - Document checked in, 14 - Document checked out, 43 - Document updated, 19 - Object deleted. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Object Share Point Object SpecialColumn true false 0 13 event id Equal Integer None Or false 1 13 None 0 14 event id Equal Integer None Or false 0 14 None 0 43 event id Equal Integer None Or false 0 43 None 1 19 event id Equal Integer None And false 0 19 None 0 LOGbndSP source Equal String None Or false 1 LOGbndSP None 1 LOGbndSC source Equal String None And false 0 LOGbndSC None 0 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:23.1910761+02:00 Daily 1 false false SharePoint\Copy of SharePoint - List Update AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c05fc409-768c-4224-9309-7b6cd1efc31d SharePoint - Access Control Changes This report lists all events (25 - 38) that could result in a user being granted more or less authority to objects in SharePoint. This includes changes to site collection administrators, group changes and object permission changes. LOGbinder SP is required in order to produce these SharePoint audit events. LOGbinder SP is a product of Monterey Technology Group, Inc. available at www.logbinder.com. Item false Occurred field 00 true false Site field 01 true false User Name field 02 true false Operation Share Point Operation SpecialColumn true false Event ID event id true false Description Share Point Object SpecialColumn true false 0 24 event id GreaterThan Integer None And false 2 24 None 1 39 event id LessThan Integer None And false 0 39 None 0 LOGbndSP source Equal String None And false 0 LOGbndSP None 1 custom logs log name Equal String None Or false 0 custom logs None 0 24 event id GreaterThan Integer None And false 2 24 None 1 39 event id LessThan Integer None And false 0 39 None 0 LOGbndSC source Equal String None And false 0 LOGbndSC None 1 custom logs log name Equal String None And false 0 custom logs None 8f8a5950-5f5d-4311-a9e5-6d66b08b32ce true 2011-12-22T16:01:25.566212+02:00 Daily 1 false false SharePoint\Copy of SharePoint - View Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 f8569a06-24ec-4df7-94b1-aa4f53889f48 Generic W3CELF ISA Log The Generic WELF ISA Log report is a report template which allows wide customization. You can use this template to generate custom reports based on WELF ISA logs. Item false Server Name s-computername true true User Name Fully Qualified User Name SpecialColumn true false Client IP c-ip true false CS-URI cs-uri-stem true false Remote IP remote address true false Remote Host remote machine id true false Port port number true false Protocol protocol true false Date date true false Time time true false 0 text log format Equal String None And false 0 text None 0 w3celf log name Equal String None And false 0 w3celf None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:12.780764+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Copy of All Critical W3CELF Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 84c20fd9-c630-4edf-9c18-6284146a633b HTTP Activity The HTTP activity report is a report template which allows wide customization. You can use this template to generate custom reports based on WELF logs. Item false Server Name computer true true Software software true false Client IP c-ip true false User Name Fully Qualified User Name SpecialColumn true false Method cs-method true false CS-URI cs-uri true false Returned Status sc-status true false Rule Name rule name true false Date date true false Time time true false 0 text log format Equal String None And false 0 text None 0 w3c log name Equal String None And false 0 w3c None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:15.5899246+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Copy of Generic W3CELF ISA Log AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 be343f36-7781-4ad8-bf39-478ca61888df Generic SysLog The Generic SYSLOG report is a report template which allows wide customization. You can use this template to generate custom reports based on SYSLOG messages. Item false Computer monitored machine true false Message message true false Facility facility true false Severity severity true false Date date true false Time time true false 0 syslog log format Equal String None And false 0 syslog None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:18.2810786+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Copy of All Critical Syslog Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 15599b64-12a7-41ff-b8ce-ec6685ce29bf Generic Windows Custom Logs The Generic Windows Custom Logs is a report which allows viewing of the custom logs events. Item false Computer Name monitored machine true true User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Description Description SpecialColumn true false Rule Name rule name true false Log Name channel 0 channel Equal String None And true 0 None log name 0 custom logs log name Equal String None And true 0 custom logs None source 0 custom logs log name Equal String None And false 0 custom logs None true false Type type true false Date date true false Time time true false 0 custom logs log name Equal String None And false 0 custom logs None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:20.9712324+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Copy of All Critical Custom Log Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fa9c8a1f-ff85-4a73-8cf7-37f55bac4b20 Generic Windows Event Log The Generic Windows Event Log report is a report template which allows wide customization. You can use this template to generate custom reports based on any windows event log, using filtering conditions and grouping modes which are not covered by the default reports. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Source source true false Description Description SpecialColumn true false Type type true false Time time true false Date date true false 0 security log name Equal String None And false 0 security None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:23.6133836+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Copy of All Critical Windows Events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e84ffb50-f076-4980-a80c-3bfdb5f1be58 GCSx Code Of Connection Memo 22 SR7 - All Actions Taken by any Individual with Root or Administrative Privileges The report shows the activity performed by users who have administrative privileges. The product uses advanced techniques to determine the following, for each event log entry: what is the user account that caused the event log entry, does the account have administrative privileges and if not, did the account have administrative privileges at the time the log entry was created. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None Or false 0 security None 0 Yes isadmin Equal Integer None And false 0 1 None 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:03:37.0229683+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\Copy of PCI DSS Requirement 10.2.2 - All Actions Taken by Any Individual with Root or Administrative Privileges AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 59574f98-00c1-4ec1-92c2-057bc737b228 GLBA - All Access to Audit Logs The report shows audit log related activity such as: audit log cleared, successful or failed attempts to access the audit logs and physical (using file managers) access to .evt files. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 517 event id Equal Integer None Or false 2 517 None 1 1102 event id Equal Integer None Or false 0 1102 None 0 578 event id Equal Integer None Or false 2 578 None 1 4674 event id Equal Integer None And false 0 4674 None 1 EventLog object type Equal String None Or false 0 EventLog None 0 560 event id Equal Integer None Or false 1 560 None 2 4656 event id Equal Integer None And false 0 4656 None 0 file object type Equal String None And false 0 file None 0 %.evt object name Like String None And false 0 %.evt None 0 security log name Equal String None And false 0 security None ce5f479d-ffb2-4346-9c9f-3d93a24ecb8b true 2012-01-20T17:52:35.1164557+02:00 Daily 1 false false GLBA Compliance\Copy of PCI DSS Requirement 10.2.3 - Access to All Audit Trails AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 78e598ae-32f0-4469-a752-76b4c260cc9f HIPAA 164.308.a.3 - All Access to Audit Logs The report shows audit log related activity such as: audit log cleared, successful or failed attempts to access the audit logs and physical (using file managers) access to .evt files. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 517 event id Equal Integer None Or false 2 517 None 1 1102 event id Equal Integer None Or false 0 1102 None 0 578 event id Equal Integer None Or false 2 578 None 1 4674 event id Equal Integer None And false 0 4674 None 1 EventLog object type Equal String None Or false 0 EventLog None 0 560 event id Equal Integer None Or false 1 560 None 2 4656 event id Equal Integer None And false 0 4656 None 0 file object type Equal String None And false 0 file None 0 %.evt object name Like String None And false 0 %.evt None 0 security log name Equal String None And false 0 security None edd4c366-2c84-4a37-9e6b-eebee1ab8efd true 2012-01-20T17:52:22.1647149+02:00 Daily 1 false false HIPAA Compliance\Copy of GLBA - All Access to Audit Logs AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8070c761-6d8c-4b3f-8c26-3607e5ddac90 SOX 302.a.4 - All Access to Audit Logs The report shows audit log related activity such as: audit log cleared, successful or failed attempts to access the audit logs and physical (using file managers) access to .evt files. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component object name true false Description Description SpecialColumn true false Date date true false Time time true false 0 517 event id Equal Integer None Or false 2 517 None 1 1102 event id Equal Integer None Or false 0 1102 None 0 578 event id Equal Integer None Or false 2 578 None 1 4674 event id Equal Integer None And false 0 4674 None 1 EventLog object type Equal String None Or false 0 EventLog None 0 560 event id Equal Integer None Or false 1 560 None 2 4656 event id Equal Integer None And false 0 4656 None 0 file object type Equal String None And false 0 file None 0 %.evt object name Like String None And false 0 %.evt None 0 security log name Equal String None And false 0 security None d73c7313-ed40-49ae-b591-3da197e02ad6 true 2012-01-20T17:51:56.5322488+02:00 Daily 1 false false SOX Compliance\Copy of HIPAA 164.308.a.3 - All Access to Audit Logs AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 01c7b8e7-1d94-438c-9b40-c1214e212cef Password Changes Operation Distribution Item false Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None Top Pie Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 60de0ee0-9510-4c76-8c76-79d186aa4411 true 2011-12-21T12:14:50.5175817+02:00 Daily 1 false false Account Management\Password Changes \Password Changes Operation Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b5c7def6-0681-4a43-9603-319d61b82579 Domain Policy Changes Container false 08ed6187-61cd-40c2-b249-6797dd7907d1 true 2011-12-21T12:16:01.1056191+02:00 Daily 1 false false Policy Changes\Domain Policy Changes 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 37a5ccf9-a180-4a67-b620-c1a356421f18 Domain Policy Changes The report is based on the 643(4739 - Vista/Longhorn) event - domain policy changed. The event identifies any change to domain audit policy. Correlate this event with changes that authorized personnel make to audit policy. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None b5c7def6-0681-4a43-9603-319d61b82579 true 2011-12-21T12:16:01.1056191+02:00 Daily 1 false false Policy Changes\Domain Policy Changes\Copy of Domain Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2c5936af-a070-4a0b-9e4e-3c80bee3def3 Domain Policy Changes Distribution Item false Policy Name domain policy changed true false Event ID event id false false % KeyCountPercentage SpecialColumn true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy Name domain policy changed true false Event ID event id false false Chart data false None b5c7def6-0681-4a43-9603-319d61b82579 true 2011-12-21T12:16:01.1056191+02:00 Daily 1 false false Policy Changes\Domain Policy Changes\Domain Policy Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ec753331-0133-4d9c-a864-c727d7a586f0 Top 10 computers with the most events A bar chart showing the top 10 computers with the most events. A table showing details on the top 10 computers with the most events. Item false Computer monitored machine true false No. of Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Bars Computer monitored machine true false Event ID event id false false Chart data true None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:04.0766527+02:00 Daily 1 false false Events Trend\Copy of Top 10 computers with the most events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ca59d011-869a-434d-b9e6-b299e57ff2eb Top 10 users generating the most events A bar chart showing the top 10 users generating the most events. A table showing details on the top 10 users generating the most events. Item false User name Fully Qualified User Name SpecialColumn true false No. of Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Bars User name Fully Qualified User Name SpecialColumn true false Event ID event id false false Chart data true None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:07.404843+02:00 Daily 1 false false Events Trend\Copy of Top 10 users generating the most events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9bd1d58e-0a5a-498d-84c0-0fd5226376ab Generic Event Trend per Hours A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one hour. Item false Computer monitored machine true true Date/Time DistinctHour SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctHour SpecialColumn true false Event ID event id false false Chart data false None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:09.484962+02:00 Daily 1 false false Events Trend\Copy of Events trend on all computers / Time AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7ac62af6-2410-47e6-98ca-336a7f598850 Generic Event Trend per Days A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one day. Item false Computer monitored machine true true Date/Time date true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time date true false Event ID event id false false Chart data false None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:11.9921054+02:00 Daily 1 false false Events Trend\Copy of Events trend on all computers / Time AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c089b8c6-00f3-4eb4-8201-6fae64e51555 Generic Event Trend per Weeks A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one week. Item false Computer monitored machine true true Date/Time DistinctWeek SpecialColumn true false Total Events KeyCount SpecialColumn true false Event ID event id false false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctWeek SpecialColumn true false Event ID event id false false Chart data false None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:14.4692471+02:00 Daily 1 false false Events Trend\Copy of Events trend on all computers / Time AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3d5ace59-aace-484a-8659-354906598faa Generic Event Trend per Months A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one month. Item false Computer monitored machine true true Date/Time DistinctMonth SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctMonth SpecialColumn true false Event ID event id false false Chart data false None d91af3d3-e42d-487e-a4a5-96bae008edef true 2011-12-21T12:18:16.7013748+02:00 Daily 1 false false Events Trend\Copy of Events trend on all computers / Time AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d5ef185f-399d-44ac-9527-a0b36f165533 User account operations distribution Item false Operation Name Account Created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None Or false 0 security None Account Enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None Or false 0 security None Account Disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None Or false 0 security None Account Deleted FixedValue 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None Or false 0 security None Account Unlocked FixedValue 0 671 event id Equal Integer None Or false 2 671 None 1 4767 event id Equal Integer None And false 0 4767 None 1 security log name Equal String None Or false 0 security None Account Renamed FixedValue 0 685 event id Equal Integer None Or false 2 685 None 1 4781 event id Equal Integer None And false 0 4781 None 1 security log name Equal String None Or false 0 security None Account Changed FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4738 event id Equal Integer None And false 0 4738 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false % KeyCountPercentage SpecialColumn true false 0 642 event id Equal Integer None Or false 1 642 None 0 624 event id Equal Integer None Or false 0 624 None 0 4720 event id Equal Integer None Or false 0 4720 None 0 626 event id Equal Integer None Or false 0 626 None 0 4722 event id Equal Integer None Or false 0 4722 None 0 629 event id Equal Integer None Or false 0 629 None 0 4725 event id Equal Integer None Or false 0 4725 None 0 4726 event id Equal Integer None Or false 0 4726 None 0 630 event id Equal Integer None Or false 0 630 None 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None Top Pie Operation Name Account Created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None Or false 0 security None Account Enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None Or false 0 security None Account Disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None Or false 0 security None Account Deleted FixedValue 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None Or false 0 security None Account Unlocked FixedValue 0 671 event id Equal Integer None Or false 2 671 None 1 4767 event id Equal Integer None And false 0 4767 None 1 security log name Equal String None Or false 0 security None Account Renamed FixedValue 0 685 event id Equal Integer None Or false 2 685 None 1 4781 event id Equal Integer None And false 0 4781 None 1 security log name Equal String None Or false 0 security None Account Changed FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4738 event id Equal Integer None And false 0 4738 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None c02258ba-8884-4d52-bf8b-9525b6be1fc9 true 2011-12-21T12:34:39.7166+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - User Account Management\Copy of User account operations distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 27f46ca6-fc18-4aec-a31c-be8ed31316dc Password Changes Operation Distribution Item false Event ID event id false false Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None Top Pie Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 984310fb-bbee-4420-855c-d5030684215f true 2011-12-21T12:35:07.7322024+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Password Changes Report\Copy of Password Changes Operation Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fe75fc44-bb18-454c-b24f-fe826415dbfc Domain Policy Change Distributions On All Computers The report shows the changes to the domain policy of the computers being monitored by EventsManager. Item false Computer monitored machine true true User Name Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy domain policy changed true false Computer monitored machine true true Query data false None b5c7def6-0681-4a43-9603-319d61b82579 true 2011-12-21T12:16:01.1056191+02:00 Daily 1 false false Policy Changes\Domain Policy Changes\Copy of Domain policy change distributions on all computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d3550b9d-4831-47db-b854-893bbc902da6 Domain Policy Change Distributions On All Computers The report shows the changes to the domain policy of the computers being monitored by EventsManager. Item false Computer monitored machine true true UserName Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy domain policy changed true false Computer monitored machine true true Query data false None 8c1a1eeb-e0b1-4a98-a0d8-964ac1d493b7 true 2011-12-21T13:06:14.6179822+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Domain Policy Changes\Copy of Domain Policy Change Distributions On All Computers AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 df9dd44b-35c4-4949-9bdb-cecf7591ffd2 Domain Policy Changes Distribution Item false Policy Name domain policy changed true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy Name domain policy changed true false Event ID event id false false Chart data false None 8c1a1eeb-e0b1-4a98-a0d8-964ac1d493b7 true 2011-12-21T13:06:14.6179822+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Domain Policy Changes\Copy of Domain Policy Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 3de9f064-6eb2-486c-8a6a-e16447f33ed6 Password Changes Operation Distribution Item false Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None Top Pie Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None d2ac4b33-10f6-4382-ade5-d2c8d9fd401d true 2011-12-21T13:04:53.8813643+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Password Changes\Copy of Password Changes Operation Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b837c370-32f5-46d0-a910-2f0bf0bb8da9 Domain Policy Changes The report is based on the 643(4739 - Vista/Longhorn) event - domain policy changed. The event identifies any change to domain audit policy. Correlate this event with changes that authorized personnel make to audit policy. Item false Computer monitored machine true true UserName Fully Qualified User Name SpecialColumn true false By User By User SpecialColumn true false Event Description Event Description SpecialColumn true false Policy domain policy changed true false Date date true false Time time true false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None 8c1a1eeb-e0b1-4a98-a0d8-964ac1d493b7 true 2011-12-21T13:06:14.6179822+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Domain Policy Changes\Copy of Domain Policy Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7a784e1a-54f5-4d4b-a9fa-a455b160567c User Account Deleted The section is based on event 630(4726 - Vista/Longhorn). Only authorized people and processes should delete network accounts. Search for these events and examine the user performing the attempt field to detect if unauthorized people have deleted accounts. Item false User Deleting The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 630 event id Equal Integer None And false 0 630 None target user name 0 4726 event id Equal Integer None And false 0 4726 None true false Target Domain target domain 0 630 event id Equal Integer None And false 0 630 None target domain name 0 4726 event id Equal Integer None And false 0 4726 None true false Date date true false Time time true false 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None And false 0 security None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 6e7e6185-15e3-4cbd-aed3-9620c11517a6 User Account Operations Distribution A chart that displays the distributions of the user account operations. Item false Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 642 event id Equal Integer None Or false 1 642 None 0 624 event id Equal Integer None Or false 0 624 None 0 4720 event id Equal Integer None Or false 0 4720 None 0 626 event id Equal Integer None Or false 0 626 None 0 4722 event id Equal Integer None Or false 0 4722 None 0 629 event id Equal Integer None Or false 0 629 None 0 4725 event id Equal Integer None Or false 0 4725 None 0 4726 event id Equal Integer None Or false 0 4726 None 0 630 event id Equal Integer None Or false 0 630 None 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None Top Pie Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false Event ID event id false false Chart data false None f80df2f4-9e70-4784-bf58-58aae6dd6620 true 2011-12-21T13:05:11.1203503+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - User Account Management\Copy of User Account Operations Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 86d9f2fe-0f7b-4f0c-a25c-33211b4c2100 User Account Deleted The section is based on event 630(4726 - Vista/Longhorn). Only authorized people and processes should delete network accounts. Search for these events and examine the user performing the attempt field to detect if unauthorized people have deleted accounts. Item false User Deleting The Account User Managing Accounts SpecialColumn true false Computer monitored machine true false Type type true false Target Account Name target account name 0 630 event id Equal Integer None And false 0 630 None target user name 0 4726 event id Equal Integer None And false 0 4726 None true false Target Domain target domain 0 630 event id Equal Integer None And false 0 630 None target domain name 0 4726 event id Equal Integer None And false 0 4726 None true false Date date true false Time time true false 0 4726 event id Equal Integer None Or false 1 4726 None 1 630 event id Equal Integer None And false 0 630 None 0 security log name Equal String None And false 0 security None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:51:09.8755802+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\Copy of User Account Deleted AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 50450e9d-1322-4cf3-863e-7492fc407b4d User Account Operations Distribution A chart that displays the distributions of the user account operations. Item false Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 642 event id Equal Integer None Or false 1 642 None 0 624 event id Equal Integer None Or false 0 624 None 0 4720 event id Equal Integer None Or false 0 4720 None 0 626 event id Equal Integer None Or false 0 626 None 0 4722 event id Equal Integer None Or false 0 4722 None 0 629 event id Equal Integer None Or false 0 629 None 0 4725 event id Equal Integer None Or false 0 4725 None 0 4726 event id Equal Integer None Or false 0 4726 None 0 630 event id Equal Integer None Or false 0 630 None 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None 1 4738 event id Equal Integer None And false 0 4738 None 0 security log name Equal String None And false 0 security None Top Pie Operation name User account created FixedValue 0 642 event id Equal Integer None Or false 2 642 None 1 4720 event id Equal Integer None And false 0 4720 None 1 security log name Equal String None And false 0 security None User account enabled FixedValue 0 626 event id Equal Integer None Or false 2 626 None 1 4722 event id Equal Integer None And false 0 4722 None 1 security log name Equal String None And false 0 security None User account disabled FixedValue 0 629 event id Equal Integer None Or false 2 629 None 1 4725 event id Equal Integer None And false 0 4725 None 1 security log name Equal String None And false 0 security None User account deleted FixedValue 0 630 event id Equal Integer None Or false 0 630 None 0 4726 event id Equal Integer None Or false 0 4726 None User account changed FixedValue 0 642 event id Equal Integer None Or false 0 642 None 0 4738 event id Equal Integer None Or false 0 4738 None User account unlocked FixedValue 0 671 event id Equal Integer None Or false 0 671 None 0 4767 event id Equal Integer None Or false 0 4767 None User account renamed FixedValue 0 685 event id Equal Integer None Or false 0 685 None 0 4781 event id Equal Integer None Or false 0 4781 None true false Event ID event id false false Chart data false None b61a36f2-be02-4012-82b8-ebfca1078224 true 2012-01-20T17:51:12.2507161+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Account Management\Copy of User Account Operations Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 a909f36b-871d-4567-af8d-6c93d83d1fbe Generic Event Trend Per Hours On All Computers A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one hour. Item false Computer monitored machine true true Date/Time DistinctHour SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctHour SpecialColumn true false Event ID event id false false Chart data false None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Copy of Generic Event Trend Per Hours AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7914ce7d-d612-43d9-9180-4478f48e449f Generic Event Trend per Days On All Computers A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one day. Item false Computer monitored machine true true Date/Time date true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time date true false Event ID event id false false Chart data false None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Copy of Generic Event Trend per Days AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 cd39c791-3bfe-4a3b-818d-78501902e01b Generic Event Trend per Weeks On All Computers A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one week. Item false Computer monitored machine true true Date/Time DistinctWeek SpecialColumn true false Total Events KeyCount SpecialColumn true false Event ID event id false false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctWeek SpecialColumn true false Event ID event id false false Chart data false None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Copy of Generic Event Trend per Weeks AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 73164e95-b7ba-4a93-9c73-7ac1019f7292 Generic Event Trend per Months On All Computers A line chart that displays the events trend on all the computers. The minimum time interval on this chart can be of one month. Item false Computer monitored machine true true Date/Time DistinctMonth SpecialColumn true false Event ID event id false false Total Events KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 security log name Equal String None Or false 0 security None 0 application log name Equal String None Or false 0 application None 0 system log name Equal String None Or false 0 system None 0 dns log name Equal String None Or false 0 dns None 0 directory log name Equal String None Or false 0 directory None 0 file replication log name Equal String None And false 0 file replication None Top Line Date/Time DistinctMonth SpecialColumn true false Event ID event id false false Chart data false None 06cc67f9-cae0-4557-a332-5ad6971d4b63 true 2011-12-21T13:03:44.1493759+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10.1 - Generic Event Trend\Copy of Generic Event Trend per Months AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 eb556f49-18ec-4f5a-a928-d6f0a5665152 Password Changes Operation Distribution Item false Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None Top Pie Operation Change Password Attempts FixedValue 0 627 event id Equal Integer None Or false 2 627 None 1 4723 event id Equal Integer None And false 0 4723 None 1 security log name Equal String None Or false 0 security None User Account Password Set Or Reset FixedValue 0 628 event id Equal Integer None Or false 2 628 None 1 4724 event id Equal Integer None And false 0 4724 None 1 security log name Equal String None Or false 0 security None Changes To Dir. Services Restore Mode Password FixedValue 0 698 event id Equal Integer None Or false 2 698 None 1 4794 event id Equal Integer None And false 0 4794 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 8f02bc8f-7002-4409-b2b7-1286a0caff2e true 2012-01-20T17:51:42.7634613+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Password Policy Changes\Copy of Password Changes Operation Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 42948274-e66a-46b2-add0-350828a2ee97 Failed logons because of bad user name or password Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component monitored machine true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 529 event id Equal Integer None Or false 1 529 None 1 4625 event id Equal Integer None Or false 0 4625 None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of Failed logons reasons other than bad user name or password AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2607d311-6395-4a3f-9773-3d7d0e048571 Generic Oracle Audit The Oracle Audit report allows viewing of the oracle server audit events. Item false Date date true false Time time true false server server true false server-hostname server-hostname true false Rule name rule name true false host name host name true false object name object name true false action action true false text data text data true false 0 Oracle Audit log format Equal String None And false 0 oracle None 260efc3b-0d0b-4ce9-9993-3e85fe0103c8 true 2011-12-21T12:31:26.085525+02:00 Daily 1 false false Miscellaneous, Customizable Reports\Generic Oracle Audit AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c1539464-e257-4e41-90dc-7df7ce882d93 Service Status This report shows the services that run, have failed to start or stopped unexpectedly. Container false 9d2cd0a2-17dd-45be-9c8c-554d321899cb true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 14fdaba9-9afe-46d0-b78a-1fed2be4262c Terminated With Error This report shows the services that stopped unexpectedly. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7031 event id Equal Integer None Or false 1 7031 None 1 7034 event id Equal Integer None And false 0 7034 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of m Service Status AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 d6802b58-2989-45a6-bfee-7a58cd3aced6 Failed To Load This report shows the services that failed to load. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7026 event id Equal Integer None And false 0 7026 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of m Service Status AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 43e2e6a2-2e4a-413d-91bc-0fdb402acdfb Failed To Start This report shows the services that failed to start. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7000 event id Equal Integer None And false 0 7000 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of m Service Status AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9f379e42-7727-418d-809e-23d08e7e2b75 Timed Out This report shows the services that timed out. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7011 event id Equal Integer None And false 0 7011 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of m Service Status AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7ba77638-f499-4cf0-ae2d-5a4146b28732 Started This report shows the services that started Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7036 event id Equal Integer None And false 0 7036 None 0 running field 01 Contains String None And false 0 running None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of m Service Status AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c0588027-d31f-4858-b3cd-638f6fa642af Stopped This report shows the services that stopped Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7036 event id Equal Integer None And false 0 7036 None 0 stopped field 01 Contains String None And false 0 stopped None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None c1539464-e257-4e41-90dc-7df7ce882d93 true 2011-12-21T12:17:41.6733713+02:00 Daily 1 false false Windows Event Log System\Service Status\Copy of Started AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fb5afad7-ad2c-447d-ac57-3da8af4c675f GCSx Code Of Connection ISO 27002 10.10 - Service Status This report shows the services that run, have failed to start or stopped unexpectedly. Container false 6bc379fe-ef83-4799-91d7-1b1b0f9e9ac6 true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1ccff808-41e4-400c-9f69-ce9b78e78fb9 Terminated With Error This report shows the services that stopped unexpectedly. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7031 event id Equal Integer None Or false 1 7031 None 1 7034 event id Equal Integer None And false 0 7034 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Terminated With Error AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 41885aee-1f27-4cc4-91a4-969105b0d321 Failed To Load This report shows the services that failed to load. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7026 event id Equal Integer None And false 0 7026 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Failed To Load AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ed92f780-a6f4-4cab-91d7-7cc1d54b0e12 Failed To Start This report shows the services that failed to start. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7000 event id Equal Integer None And false 0 7000 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Failed To Start AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c077e7de-c219-4bee-aa33-dfb439cb1720 Timed Out This report shows the services that timed out. Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7011 event id Equal Integer None And false 0 7011 None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Timed Out AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b6e4243c-3ec5-4269-ba0f-5c17f7431042 Started This report shows the services that started Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7036 event id Equal Integer None And false 0 7036 None 0 running field 01 Contains String None And false 0 running None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Started AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fd4e4ea9-a280-4b25-9390-4adb5993cf74 Stopped This report shows the services that stopped Item false Computer monitored machine true false User Name Fully Qualified User Name SpecialColumn true false Event ID event id true false Type type true false Description Description SpecialColumn true false Date date true false Time time true false 0 7036 event id Equal Integer None And false 0 7036 None 0 stopped field 01 Contains String None And false 0 stopped None 0 Service Control Manager source Equal String None And false 0 Service Control Manager None 0 system log name Equal String None And false 0 system None fb5afad7-ad2c-447d-ac57-3da8af4c675f true 2011-12-21T13:06:46.3697983+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection ISO 27002 10.10 - Service Status\Copy of Stopped AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e2c93238-2fc7-41ed-a148-0000dab4db7a NTLM Logon attempts The group is based on event 680(4776 - Vista/Longhorn) - Account used for logon and 681(4777 - Vista/Longhorn) - Logon to account failed. The evens identify the account used for the successful or failed domain logon attempts. Event 680 is logged on Windows 2003 domains both for successful and failed attempts. On Windows 2000 domains, event 680 is logged only for successful attempts while event 681 is logged for failed attempts. Item false Computer monitored machine true false Type type 0 4776 event id LessThan Integer None Or false 0 4776 None 0 4776 event id GreaterThan Integer None And false 0 4776 None Success FixedValue 0 4776 event id Equal Integer None And false 0 4776 None true false Description Description SpecialColumn true false Logon Account Account SpecialColumn 0 680 event id Equal Integer None Or false 0 680 None 0 681 event id Equal Integer None And false 0 681 None target user name 0 4776 event id Equal Integer None And false 0 4776 None true false Source Workstation from workstation 0 681 event id Equal Integer None And false 0 681 None workstation 0 4776 event id Equal Integer None And false 0 4776 None source workstation 0 680 event id Equal Integer None And false 0 680 None true false Error Code the error code was 0 681 event id Equal Integer None And false 0 681 None error code 0 680 event id Equal Integer None And false 0 680 None true false Time time true false Date date true false 0 680 event id Equal Integer None Or false 1 680 None 0 681 event id Equal Integer None Or false 0 681 None 0 4776 event id Equal Integer None Or false 0 4776 None 1 4777 event id Equal Integer None And false 0 4777 None 0 security log name Equal String None Or false 0 security None bb3745f1-c3c6-4ec6-859e-bcba7d84b0c1 true 2011-12-21T12:13:37.6834158+02:00 Daily 1 false false Account Usage\Account Logons\Copy of NTLM Logon attempts AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e50dcfe0-2618-47a7-ab41-cf0414b98388 IPSec security events Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component source true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 613 event id Equal Integer None Or false 1 613 None 0 614 event id Equal Integer None Or false 0 614 None 0 615 event id Equal Integer None Or false 0 615 None 0 4709 event id Equal Integer None Or false 0 4709 None 0 4710 event id Equal Integer None Or false 0 4710 None 1 4711 event id Equal Integer None Or false 0 4711 None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of Kerberos pre-authentication failed AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9acd2f0d-7c9b-486a-b270-e24d7f29cb8f Terminal Services account logon events Use of Identification and Authentication Mechanisms Report for PCI DSS requirement 10.2.5 - The report lists entries relevant to the use of identification and authentication mechanisms, such as: successful and failed logons, events related to authentication protocols (for NTLM and Kerberos) and events logged by the subsystems handling authentication. Item false User Identification User Identification SpecialColumn true false Type of event category true false Success or Failure Indication type true false Origination of event monitored machine true false Identity or name of affected data, resource or component source true false Description Description SpecialColumn true false Date date true false Time time true false 0 security log name Equal String None And false 0 security None 0 683 event id Equal Integer None Or false 1 683 None 1 682 event id Equal Integer None And false 0 682 None 422f119b-5294-4a9e-b5b8-550f13a16881 true 2011-12-21T12:35:46.4984197+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 10.2.5 - Use of Identification and Authentication Mechanisms\Copy of IPSec security events AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 91ffd5b0-d7ff-421a-b9f6-485a9ca534f9 Security Enabled Group Changes Distribution A pie chart showing the distribution of the security group changes. Item false Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 630 event id GreaterThan Integer None And false 2 630 None 1 640 event id LessThan Integer None Or false 0 640 None 0 658 event id GreaterThan Integer None And false 1 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4736 event id LessThan Integer None Or false 0 4736 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 1 4759 event id LessThan Integer None Or false 0 4759 None 0 4737 event id Equal Integer None Or false 0 4737 None 1 4764 event id Equal Integer None And false 0 4764 None 0 security log name Equal String None And false 0 security None Top Pie Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 06c90f06-7859-49e5-bdbe-a5ea31afff7f true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management\Copy of Security Enabled Group Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 db313113-41d7-47be-96ec-f28861ff6618 Security Enabled Global Group Changes The section is based on events from 631 to 634 (4727 to 4730 - Vista/Longhorn) , and 641(4737 - Vista/Longhorn) events. Examine this section for groups that have global or broad access privileges, such as the Domain Admins group, to ensure that no changes occur outside organizational policy constraints. Item false User Perfoming Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 06c90f06-7859-49e5-bdbe-a5ea31afff7f true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management\Copy of Security Enabled Global Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 e5f28b88-e8d8-4756-8be7-86654a8fbe7c Security Enabled Local Group Changes The section is based on events from 635 to 639(4731 to 4735 - Vista/Longhorn). Examine this section for groups such as Administrators, Server Operators, and Backup Operators to ensure that no changes take place outside of policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 06c90f06-7859-49e5-bdbe-a5ea31afff7f true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management\Copy of Security Enabled Local Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 47d92df5-72d6-41e0-ae46-551a64eca89a Security Enabled Universal Group Changes The section is based on events from 659 to 662(4755 to 4758 - Vista/Longhorn). Examine for groups that have high privilege levels, such as Enterprise Admins or Schema Admins, to ensure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name 0 632 event id GreaterThan Integer None And false 1 632 None 1 638 event id Equal Integer None Or false 0 638 None 0 659 event id GreaterThan Integer None And false 1 659 None 1 662 event id LessThan Integer None Or false 0 662 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None new account name 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None target user name 0 4727 event id GreaterThan Integer None And false 1 4727 None 1 4735 event id LessThan Integer None Or false 0 4735 None 0 4755 event id GreaterThan Integer None And false 1 4755 None 1 4758 event id LessThan Integer None Or false 0 4758 None 0 4737 event id Equal Integer None Or false 0 4737 None 0 4764 event id Equal Integer None Or false 0 4764 None true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 06c90f06-7859-49e5-bdbe-a5ea31afff7f true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management\Copy of Security Enabled Universal Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 1b03a642-7b64-4725-b17c-84b44e731faf Security Enabled Group Type Changes The section is based on the 668(4764 - Vista/Longhorn) event. It indicates changes to the group type. You should examine these events for groups that have high privilege levels to make sure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Date date true false Time time true false 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None 06c90f06-7859-49e5-bdbe-a5ea31afff7f true 2011-12-21T12:34:16.2822596+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 7.1 - Security Group Management\Copy of Security Enabled Group Type Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 dae17dbe-f676-4ba2-a126-daa7bf3e8404 Security Enabled Group Changes Distribution A pie chart showing the distribution of the security group changes. Item false Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 630 event id GreaterThan Integer None And false 2 630 None 1 640 event id LessThan Integer None Or false 0 640 None 0 658 event id GreaterThan Integer None And false 1 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4736 event id LessThan Integer None Or false 0 4736 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 1 4759 event id LessThan Integer None Or false 0 4759 None 0 4737 event id Equal Integer None Or false 0 4737 None 1 4764 event id Equal Integer None And false 0 4764 None 0 security log name Equal String None And false 0 security None Top Pie Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 69c570a0-b3c8-4c00-bd31-17e2efe228db true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management\Copy of Security Enabled Group Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 829bc4b8-9078-4acb-adf8-350cf8bf9e96 Security Enabled Group Type Changes The section is based on the 668(4764 - Vista/Longhorn) event. It indicates changes to the group type. You should examine these events for groups that have high privilege levels to make sure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Date date true false Time time true false 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None a4fb9a7e-a142-45f3-9326-1df162466683 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management\Copy of Security Enabled Group Type Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 4310704c-b1bc-4a63-a1ca-8371e436b1f8 Security Enabled Universal Group Changes The section is based on events from 659 to 662(4755 to 4758 - Vista/Longhorn). Examine for groups that have high privilege levels, such as Enterprise Admins or Schema Admins, to ensure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name 0 632 event id GreaterThan Integer None And false 1 632 None 1 638 event id Equal Integer None Or false 0 638 None 0 659 event id GreaterThan Integer None And false 1 659 None 1 662 event id LessThan Integer None Or false 0 662 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None new account name 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None target user name 0 4727 event id GreaterThan Integer None And false 1 4727 None 1 4735 event id LessThan Integer None Or false 0 4735 None 0 4755 event id GreaterThan Integer None And false 1 4755 None 1 4758 event id LessThan Integer None Or false 0 4758 None 0 4737 event id Equal Integer None Or false 0 4737 None 0 4764 event id Equal Integer None Or false 0 4764 None true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69c570a0-b3c8-4c00-bd31-17e2efe228db true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management\Copy of Security Enabled Universal Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 032b62fd-b809-47c4-808e-5219d1deacc0 Security Enabled Group Type Changes The section is based on the 668(4764 - Vista/Longhorn) event. It indicates changes to the group type. You should examine these events for groups that have high privilege levels to make sure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Date date true false Time time true false 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None 69c570a0-b3c8-4c00-bd31-17e2efe228db true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management\Copy of Security Enabled Group Type Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7f52f532-a0da-46aa-8ac2-66d85f80a9fe Security Enabled Local Group Changes The section is based on events from 635 to 639(4731 to 4735 - Vista/Longhorn). Examine this section for groups such as Administrators, Server Operators, and Backup Operators to ensure that no changes take place outside of policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69c570a0-b3c8-4c00-bd31-17e2efe228db true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management\Copy of Security Enabled Local Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2b19dc65-8dd5-43bc-8b55-8068f55236f4 Security Enabled Global Group Changes The section is based on events from 631 to 634 (4727 to 4730 - Vista/Longhorn) , and 641(4737 - Vista/Longhorn) events. Examine this section for groups that have global or broad access privileges, such as the Domain Admins group, to ensure that no changes occur outside organizational policy constraints. Item false User Perfoming Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69c570a0-b3c8-4c00-bd31-17e2efe228db true 2011-12-21T12:36:23.7305493+02:00 Daily 1 false false PCI DSS Compliance\PCI DSS Requirement 8.5.1 - Security Group Management\Copy of Security Enabled Global Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0cb28d30-e84b-48ba-be4f-75d239033ebb Security Enabled Universal Group Changes The section is based on events from 659 to 662(4755 to 4758 - Vista/Longhorn). Examine for groups that have high privilege levels, such as Enterprise Admins or Schema Admins, to ensure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name 0 632 event id GreaterThan Integer None And false 1 632 None 1 638 event id Equal Integer None Or false 0 638 None 0 659 event id GreaterThan Integer None And false 1 659 None 1 662 event id LessThan Integer None Or false 0 662 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None new account name 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None target user name 0 4727 event id GreaterThan Integer None And false 1 4727 None 1 4735 event id LessThan Integer None Or false 0 4735 None 0 4755 event id GreaterThan Integer None And false 1 4755 None 1 4758 event id LessThan Integer None Or false 0 4758 None 0 4737 event id Equal Integer None Or false 0 4737 None 0 4764 event id Equal Integer None Or false 0 4764 None true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None a4fb9a7e-a142-45f3-9326-1df162466683 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management\Copy of Security Enabled Universal Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 7c4fd4fc-2f10-4410-948c-51bcfc1aab32 Security Enabled Global Group Changes The section is based on events from 631 to 634 (4727 to 4730 - Vista/Longhorn) , and 641(4737 - Vista/Longhorn) events. Examine this section for groups that have global or broad access privileges, such as the Domain Admins group, to ensure that no changes occur outside organizational policy constraints. Item false User Perfoming Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None a4fb9a7e-a142-45f3-9326-1df162466683 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management\Copy of Security Enabled Global Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 9f27db85-8459-4bec-90e1-f046a40e2a6a Security Enabled Local Group Changes The section is based on events from 635 to 639(4731 to 4735 - Vista/Longhorn). Examine this section for groups such as Administrators, Server Operators, and Backup Operators to ensure that no changes take place outside of policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None a4fb9a7e-a142-45f3-9326-1df162466683 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management\Copy of Security Enabled Local Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 77512f62-05dc-4fc9-8386-64afb4847aed Security Enabled Group Changes Distribution A pie chart showing the distribution of the security group changes. Item false Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 630 event id GreaterThan Integer None And false 2 630 None 1 640 event id LessThan Integer None Or false 0 640 None 0 658 event id GreaterThan Integer None And false 1 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4736 event id LessThan Integer None Or false 0 4736 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 1 4759 event id LessThan Integer None Or false 0 4759 None 0 4737 event id Equal Integer None Or false 0 4737 None 1 4764 event id Equal Integer None And false 0 4764 None 0 security log name Equal String None And false 0 security None Top Pie Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None a4fb9a7e-a142-45f3-9326-1df162466683 true 2011-12-21T13:04:35.0482871+02:00 Daily 1 false false GCSx Code of Connection General and Security Requirements\GCSx Code Of Connection Memo 22 SR7 - Security Group Management\Copy of Security Enabled Group Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 77045b87-7795-46b9-9d37-83f7bf197453 Security Enabled Group Changes Distribution A pie chart showing the distribution of the security group changes. Item false Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 630 event id GreaterThan Integer None And false 2 630 None 1 640 event id LessThan Integer None Or false 0 640 None 0 658 event id GreaterThan Integer None And false 1 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4736 event id LessThan Integer None Or false 0 4736 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 1 4759 event id LessThan Integer None Or false 0 4759 None 0 4737 event id Equal Integer None Or false 0 4737 None 1 4764 event id Equal Integer None And false 0 4764 None 0 security log name Equal String None And false 0 security None Top Pie Group name Global Group FixedValue 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Local Group FixedValue 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Universal Group FixedValue 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Group Type FixedValue 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None true false Event ID event id false false Chart data false None 69963a76-678e-40b9-bdce-78a0d98f530e true 2012-01-20T17:51:17.9980448+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Group Management\Copy of Security Enabled Group Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 2361501d-c10b-48d5-b886-22f70bd584eb Security Enabled Group Type Changes The section is based on the 668(4764 - Vista/Longhorn) event. It indicates changes to the group type. You should examine these events for groups that have high privilege levels to make sure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Date date true false Time time true false 0 668 event id Equal Integer None Or false 2 668 None 1 4764 event id Equal Integer None And false 0 4764 None 1 security log name Equal String None And false 0 security None 69963a76-678e-40b9-bdce-78a0d98f530e true 2012-01-20T17:51:20.9622144+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Group Management\Copy of Security Enabled Group Type Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 bd82f952-ed51-4b12-a8f4-40de237ddcd1 Security Enabled Universal Group Changes The section is based on events from 659 to 662(4755 to 4758 - Vista/Longhorn). Examine for groups that have high privilege levels, such as Enterprise Admins or Schema Admins, to ensure that no changes take place outside policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name 0 632 event id GreaterThan Integer None And false 1 632 None 1 638 event id Equal Integer None Or false 0 638 None 0 659 event id GreaterThan Integer None And false 1 659 None 1 662 event id LessThan Integer None Or false 0 662 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 668 event id Equal Integer None Or false 0 668 None new account name 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None target user name 0 4727 event id GreaterThan Integer None And false 1 4727 None 1 4735 event id LessThan Integer None Or false 0 4735 None 0 4755 event id GreaterThan Integer None And false 1 4755 None 1 4758 event id LessThan Integer None Or false 0 4758 None 0 4737 event id Equal Integer None Or false 0 4737 None 0 4764 event id Equal Integer None Or false 0 4764 None true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 658 event id GreaterThan Integer None And false 3 658 None 1 663 event id LessThan Integer None Or false 0 663 None 0 4754 event id GreaterThan Integer None And false 1 4754 None 2 4759 event id LessThan Integer None And false 0 4759 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69963a76-678e-40b9-bdce-78a0d98f530e true 2012-01-20T17:51:23.456357+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Group Management\Copy of Security Enabled Universal Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 8ce93851-4b18-47b4-8a7f-f0d25c116e02 Security Enabled Local Group Changes The section is based on events from 635 to 639(4731 to 4735 - Vista/Longhorn). Examine this section for groups such as Administrators, Server Operators, and Backup Operators to ensure that no changes take place outside of policy constraints. Item false User Performing Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 634 event id GreaterThan Integer None And false 3 634 None 1 640 event id LessThan Integer None Or false 0 640 None 0 4730 event id GreaterThan Integer None And false 1 4730 None 2 4736 event id LessThan Integer None And false 0 4736 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69963a76-678e-40b9-bdce-78a0d98f530e true 2012-01-20T17:51:25.9164977+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Group Management\Copy of Security Enabled Local Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 c2def841-5776-4ed7-95a6-13ba0b4cc7bb Security Enabled Global Group Changes The section is based on events from 631 to 634 (4727 to 4730 - Vista/Longhorn) , and 641(4737 - Vista/Longhorn) events. Examine this section for groups that have global or broad access privileges, such as the Domain Admins group, to ensure that no changes occur outside organizational policy constraints. Item false User Perfoming Operation User Managing Groups SpecialColumn true false Computer monitored machine true false Type type true false Changed Group target account name true false Operation Operation SpecialColumn true false Event ID event id false false Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Date date true false Time time true false 0 630 event id GreaterThan Integer None And false 3 630 None 1 635 event id LessThan Integer None Or false 0 635 None 0 4726 event id GreaterThan Integer None And false 1 4726 None 1 4731 event id LessThan Integer None Or false 0 4731 None 0 641 event id Equal Integer None Or false 0 641 None 1 4737 event id Equal Integer None And false 0 4737 None 1 security log name Equal String None Or false 0 security None Top Pie Operation name Group created FixedValue 0 631 event id Equal Integer None Or false 0 631 None 0 635 event id Equal Integer None Or false 0 635 None 0 658 event id Equal Integer None Or false 0 658 None 0 4727 event id Equal Integer None Or false 0 4727 None 0 4731 event id Equal Integer None Or false 0 4731 None 0 4754 event id Equal Integer None And false 0 4754 None Member added FixedValue 0 632 event id Equal Integer None Or false 0 632 None 0 636 event id Equal Integer None Or false 0 636 None 0 660 event id Equal Integer None Or false 0 660 None 0 4728 event id Equal Integer None Or false 0 4728 None 0 4732 event id Equal Integer None Or false 0 4732 None 0 4756 event id Equal Integer None Or false 0 4756 None Member removed FixedValue 0 633 event id Equal Integer None Or false 0 633 None 0 637 event id Equal Integer None Or false 0 637 None 0 661 event id Equal Integer None Or false 0 661 None 0 4729 event id Equal Integer None Or false 0 4729 None 0 4733 event id Equal Integer None Or false 0 4733 None 0 4757 event id Equal Integer None Or false 0 4757 None Group deleted FixedValue 0 634 event id Equal Integer None Or false 0 634 None 0 638 event id Equal Integer None Or false 0 638 None 0 662 event id Equal Integer None Or false 0 662 None 0 4730 event id Equal Integer None Or false 0 4730 None 0 4734 event id Equal Integer None Or false 0 4734 None 0 4758 event id Equal Integer None Or false 0 4758 None Group changed FixedValue 0 659 event id Equal Integer None Or false 0 659 None 0 639 event id Equal Integer None Or false 0 639 None 0 641 event id Equal Integer None Or false 0 641 None 0 4755 event id Equal Integer None Or false 0 4755 None 0 4735 event id Equal Integer None Or false 0 4735 None 0 4737 event id Equal Integer None Or false 0 4737 None Group type changed FixedValue 0 668 event id Equal Integer None Or false 0 668 None 0 4764 event id Equal Integer None Or false 0 4764 None false false Event ID event id false false Query data false None 69963a76-678e-40b9-bdce-78a0d98f530e true 2012-01-20T17:51:28.9146692+02:00 Daily 1 false false SOX Compliance\SOX 302.a.6 - Group Management\Copy of Security Enabled Global Group Changes AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 fd24b378-c17d-4d52-9953-5255b68bc3ef Domain Policy Changes Distribution Item false Policy Name domain policy changed true false % KeyCountPercentage SpecialColumn true false Event ID event id false false 0 643 event id Equal Integer None Or false 1 643 None 1 4739 event id Equal Integer None And false 0 4739 None 0 security log name Equal String None And false 0 security None Top Pie Policy Name domain policy changed true false Event ID event id false false Chart data false None c05fd2d4-75e4-4bdb-b4f6-b0d3dd418aa7 true 2012-01-20T17:51:53.1870575+02:00 Daily 1 false false SOX Compliance\SOX 302.a.5 - Domain Policy Changes\Copy of Domain Policy Changes Distribution AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 19c47b32-d2e1-4757-89ea-468fbe777481 All Critical Oracle Events Container false 8360c38f-6b13-4d9c-958e-1c1382f4f317 true 2011-12-21T12:20:38.23447+02:00 Daily 1 false false All Critical Messages\All Critical Oracle Events 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 5488445b-72b7-4f46-9a31-4ad63b432ec2 Top 10 Rules Triggered A pie chart showing the top 10 rules that were triggered and a table showing the top 10 triggered rules and the number of events that have activated each particular rule. Item false Rule Name rule name true false Event ID event id false false Count KeyCount SpecialColumn true false % KeyCountPercentage SpecialColumn true false 0 Oracle Audit log format Equal String None And false 0 oracle None 0 Critical importance Equal Integer None And false 0 4 None Top Pie Rule Name rule name true false Event ID event id false false Chart data true None 19c47b32-d2e1-4757-89ea-468fbe777481 true 2011-12-21T12:20:38.23447+02:00 Daily 1 false false All Critical Messages\All Critical Oracle Events\Copy of Top 10 Rules Triggered AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 ad00e8f0-5ab4-4fb1-a184-85d6d6b21250 All Critical Microsoft Oracle Server Audit A table showing all the events that correspond to the current filtering conditions. Item false Server monitored machine true true Event Class event class true false Application Name application name true false Database Name database name true false Login Name login name true false Date date true false Time time true false Text Data text data true false 0 Oracle Audit log format Equal String None And false 0 oracle None 0 Critical importance Equal Integer None And false 0 4 None 19c47b32-d2e1-4757-89ea-468fbe777481 true 2011-12-21T12:20:38.23447+02:00 Daily 1 false false All Critical Messages\All Critical Oracle Events\Copy of All Critical Microsoft Sql Server Audit AllTime Today 0001-01-01T00:00:00 None 0 0001-01-01T00:00:00 0001-01-01T00:00:00 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 b95685ec-c61e-46cd-9e08-dcff69070651 Custom Reports Container false true 1800-01-01T00:00:00 None false Custom 0 0 0 false false false 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00 0001-01-01T00:00:00