Getting Started

This quick start demonstrates the most important features of DirX Audit and illustrates the typical way to work with DirX Audit Manager in a customer environment. It consists of several nearly independent sections that describe typical DirX Audit use cases:

  • How to analyze aggregated data with the DirX Audit Manager Dashboard view.

  • How to analyze audit events with the DirX Audit Manager Audit analysis.

  • How to analyze history entries of audit events with the DirX Audit Manager History view.

  • How to set up and run DirX Audit reports with the DirX Audit Manager Reports view. For information on how to customize reports, see the DirX Audit Customization Guide.

After performing these quick start sections, you should be able to:

  • Understand and use most of DirX Audit’s powerful features.

Before You Begin

Before you can use the quick start, you must:

This tutorial also assumes that you are running the DirX Identity My-Company sample domain and that you can use the My-Company users to log in to DirX Audit Manager. See the DirX Identity Tutorial for details about the My-Company sample domain and its users.

If you are familiar with the DirX Identity Tutorial, which is the original source of data for this tutorial, you can also follow and compare individually performed steps.

Preparing to Use the Tutorial

Before we can proceed with the tutorial, we need to perform the following tasks:

  • Set up the event context calculation

  • Load the sample data (events) from the DirX Identity source

  • Load the sample data (events) from the DirX Access source

  • Load the sample DirX Identity history data

  • Calculate history data foreign keys and sample KPI tables

Setting up the Event Context Calculation

A context record contains data on the causing event for most audit events. In particular, it holds names of requesters and approvers in approval activities. DirX Audit Server calculates these values regularly. We need to edit the server configuration file for populating context records before loading the sample data so that the data loaded in the next steps are calculated with the correct time scope.

  • Navigate to the tenant route deployment folder
    install_path/server_container/tenants/tenantID/deploy/routes/.
    Copy the tenant context record calculation route XML file route-dxt-scheduler-populatecontextrecords-version.xml to a safe location outside of the tenant route deployment folder. We need to save a copy of the original file so that we can restore it later after we complete the steps to load the sample data.

  • In the deployment folder, open the route-dxt-scheduler-populatecontextrecords-version.xml for editing.

  • Find the Run on configured time trigger section and modify the jobdatamap.arg_from and the jobdatamap.arg_orphan_to parameters. If you want to see the same results as described in this tutorial, you must calculate contexts for all tutorial data which come from 09/2025 or 10/2025. For example, if you start tutorial data calculation in 08/2025, you must set jobdatamap.arg_from=RAW(TM-40) and jobdatamap.arg_orphan_to=RAW(TM-40) to make sure the data is calculated. The interval should be the same for both parameters. Save the file.

  • The calculation runs several times according to the set scheduler and maximum of results until it counts all the contexts; for our data, it takes about half an hour. If you need to speed it up, you can change the scheduler and increase the jobdatamap.arg_max_result parameter to a larger value to calculate contexts faster. For example, you could change it to jobdatamap.arg_max_result=1000.

  • When you have completed your modifications to the tenant context record calculation route XML file, move the modified file to a location outside of the tenant route deployment folder so that it disappears from the folder. (Make sure not to overwrite the original XML file you copied in the first step). This action unregisters the original version of the file with the server.

  • Now move your modified file back into the tenant route deployment folder. This action registers your modified file with the server so that the modifications are reflected in the job scheduling.

  • You should revert the scheduled context calculation job back to the original state after all contexts have been calculated. To check that calculation is finished, check the dirxaudit-server.log file in install_path/server_container/tenants/tenantID/logs.
    When you find the message Created context for 0 audit messages. … PopulateContextRecordsJob has finished., you can be sure that all contexts have already been calculated.
    Delete the modified route-dxt-scheduler-populatecontextrecords-version.xml route file in the tenant route deployment folder and then copy the original route backup file you copied and saved in the very first step back into the tenant route deployment folder. This action resets the original context calculation job settings.

  • Now proceed with the next sample data loading steps.

After running the context calculation, you should see the correct contexts in the Audit analysis details view in several context-based reports and in the History details view.

Loading the Sample Data from the DirX Identity Source

DirX Audit comes with a pre-defined set of sample data from the DirX Identity source. This data was prepared by performing the DirX Identity Tutorial and it is stored in DirX Identity XML file format. To load this data into an empty (data) database, we need to:

  • Navigate to the folder install_media/Additions/Data/SampleData/Identity/Data on your DirX Audit installation media.

  • Copy all files named dxi_audit_number.xml and dxi_auditTrail_number.xml in this folder to the input folder you specified for DirX Audit file collector imports when you configured the collectors for your tenant; for example, C:/dxt/input/file/tenantID/dxi.
    Be sure to copy the files into the correct folder configured for your tenant.

In the file names above, number is a number assigned to the file when it was created during the DirX Identity. The suffix _audit distinguishes the audit messages from the JMS queue and _auditTrail the audit messages collected from LDAP.
The DirX Audit Server creates the input folder - for example, dxi - when it first starts up. If this folder does not currently exist in your installation, you can create it yourself in the input folder and then copy the files to it, or you can start the DirX Audit Server first and then copy the files.
If you do not know the path to the input folder for DirX Audit file collector imports, you can find it by looking in the Tenant Configuration Wizard tabs. For this tutorial, the relevant component is:
Server File Collector for DirX Identity Format

Search for the parameter Input folder. If you insert only the folder name without the full path in the Tenant Configuration Wizard; the input folder is created in the install_path/server_container/tenants/tenantID/ folder.

  • If you have not started DirX Audit Server service, start it now. This action triggers the file collectors to import the files in the input folder into the DirX Audit Database (we recommend importing all files). After a few minutes, the files you copied should disappear from the input folder (for example, C:/dxt/input/file/tenantID/dxi).

If your DirX Audit installation has set up the DirX Audit components like the DirX Audit Server as system services, you can start and stop the DirX Audit Server as you would any other operating system service; for example, on Windows, from the Services panel. See the subsection on installing system services in Chapter 5 of the DirX Audit Installation Guide for more details.

Loading the Sample Data from the DirX Access Source

DirX Audit also comes with a pre-defined set of sample data from the DirX Access source. To load this data into your database:

  • Navigate to the folder install_media/Additions/Data/SampleData/Access on your DirX Audit installation media.

  • Copy all files named dirx_access_number_sampledata.xml in this folder to the input folder you specified for DirX Access file collector imports when you configured the collectors for the tenant; for example, C:/dxt/input/file/tenantID/dxa. Be sure to copy the files into the correct folder configured for your tenant.

The DirX Audit Server creates the input folder - for example, dxa - when it first starts up. If this folder does not currently exist in your installation, you can create it yourself in the input folder and then copy the files to it, or you can start the DirX Audit Server first and then copy the files.
If you do not know the path to the input folder for DirX Audit file collector imports, you can find it by looking in the Tenant Configuration Wizard tabs. For this section, the relevant component is:
Server File Collector for DirX Access Format

Search for the parameter Input folder. If you insert only the folder name without the full path in the Tenant Configuration Wizard; the input folder is created in the install_path/server_container/tenants/tenantID/ folder.

  • If you have not started DirX Audit Server service, start it now. This action triggers the file collectors to import the files in the input folder into the DirX Audit Database (we recommend importing all files). After a few seconds, the files you copied should disappear from the input folder (for example, C:/dxt/input/file/tenantID/dxa).

  • When all contexts have been calculated, copy the saved original route-dxt-scheduler-populatecontextrecords-version.xml back into the deployment folder. This action registers the original settings with the server and restores the scheduled context record population to its original state. You can check to see if the calculation has finished by checking the dirxaudit-server.log file in
    install_path/server_container/tenants/tenantID/logs, where you can find logged messages indicating that no new contexts are calculated; for example,
    | PopulateContextRecordsJob | - - | Finished job for context records calculation for tenant '27998a9d-d518-40c1-92c8-636573608c28'. Created context for 0 audit messages..

Loading the Sample DirX Identity History Data

The history database is usually populated by scheduled history synchronization server jobs, synchronizing DirX Identity entries snapshots as history entries into the DirX Audit history database. To facilitate the DirX Audit tutorial environment setup without the need to configure a connection from DirX Identity and the history synchronization job, we provide a set of LDIF files that contain exported history entries.

We’ll use the DB maintenance tool (described in more detail in the DirX Audit Command Line Interface Guide) and specify the target tenant with its history database to load these prepared history entries automatically into the specified DirX Audit database:

  • Navigate to the folder install_media/Additions/Data/SampleData/Identity/History on your DirX Audit installation media and then copy its contents to your hard drive to the folder install_path/tools/db_maintenance/bin.

  • Before running the batch file, which will import the history data you have to modify it by specifying the tenant ID - for example the already configured tenant which includes the target history database into which the history entries will be imported. Edit the install_path/tools/db_maintenance/bin/dxtTutorialLdif2Histdb.bat file and replace all occurrences of *tenantid* with the ID of your target tenant.

  • Now start the command line as administrator from the Start menu and run the batch tool install_path/tools/db_maintenance/bin/dxtTutorialLdif2Histdb.bat. This action automatically loads all the prepared history entries sets into the DirX Audit database specified in the connection file. There are several sets of history entries representing individual DirX Identity Tutorial exercises, so the loading procedure will run repeatedly in several cycles and can take up to 15 minutes to complete.

  • If you’re working with the Oracle database, you’ll be able to see the entry attributes after running DXT_HISTORY_VIEW_PROCEDURE. By default, it is set to run once a day during the night. To be able to see the changes immediately, contact your database administrator to run Procedures/DXT_HISTORY_VIEW_REFRESH manually. As some history views are based on foreign keys, this procedure should be run after calculating history data foreign keys as described in the next step.

Calculating History Data Foreign Keys

After we’ve loaded the sample DirX Identity history entries into the history database, we also need to calculate the foreign keys. This procedure connects related entries, which results in the display of related DNs in entry attributes as links in the Manager application. By default, the DirX Audit Server calculates the keys regularly every night. However, we want the calculation to occur right now, instead of having to wait until the next day. To trigger immediate calculation, we need to edit the server configuration file to enable the predefined 30-second trigger:

  • Navigate to the folder install_path/server_container/tenants/tenantID/deploy/routes/. Copy the tenant foreign keys calculation rout XML file route-dxt-scheduler-updatehistdb.xml to a safe location outside of the tenant route deployment folder. We need to save a copy of the original file so that we can restore it later after we complete the steps to load the sample data.

  • In the deployment folder, open the route-dxt-scheduler-updatehistdb.xml for editing.

  • Uncomment the Run immediately - only once trigger section and comment out the Run on configured time trigger section.

  • Modify 2 values - (TD-7) and (TD-30) to cover all tutorial data which come from 09/2025 or 10/2025. For example, if you start the tutorial history data foreign keys calculation in August 2025, you must set both values to TM-40 which covers 40 months into the past. Save the file.

  • Next, copy the modified file to a safe location outside of the tenant route deployment folder. Delete the modified route XML file that exists in the tenant route deployment folder and then copy your saved modified version back into the folder. These steps ensure that the modified settings are reflected in the job scheduling.

  • Wait five minutes to make sure that all the foreign keys have been computed. You can optionally check this in the dirxaudit-server.log server log file in install_path/server_container/tenants/tenantID/logs where you can find logged messages indicating that the recalculation has already been performed and so no new foreign keys need to be added; for example, UpdateHistoryDbJob has finished.
    The visible result of this action is that when you open any history entry details page, there will be active links to other related or assigned history entries; for example, user Alle Nicolas with links to his assigned accounts and privileges, his organizational unit and so on.

  • Revert the changes to prevent constant running of the update job: delete the modified route-dxt-scheduler-updatehistdb.xml route file in the tenant route deployment folder and then copy the original route backup file you copied and saved in the very first step back into the tenant route deployment folder. This action resets the original foreign key calculation job settings.

Calculating the Sample KPIs

DirX Audit can show KPI values in a form of chart. The aggregated source data for charts is calculated from audit events and messages and also from history entries. DirX Audit Server calculates the values regularly. For immediate calculation of the aggregated data you can use the fact population command-line tool installed as a part of DirX Audit.

  • Navigate to the folder install_path/tools/db_fact_population/bin.

  • Start the fact population tool by running dxtPopulateFacts -tenantid tenantID; where tenantID specifies the identifier of a configured tenant. For example:

    dxtPopulateFacts -tenantid 71a75691-d28a-48ce-a542-6d6af7ece680

The tool populates a set of OLAP structures that contains aggregated data for presenting KPI values.
It uses database connectivity settings stored in the configuration file of the specified tenant.
See the DirX Audit Command Line Interface Guide for more details on how to use the command-line interface. See the subsection on installing system services in Chapter 5 of the DirX Audit Installation Guide for more details. You can also check the result of this action later in the Dashboard view.

Working with the Tutorial

Once you have completed your preparation for the tutorial, you should back up the example database so that you can restore the prepared example database later on. It is also a good idea to back up your example database each time you successfully complete a quick start exercise. This way, you can retry any exercise or solve a problem by stepping back without having to return to the very first exercise.

Refer to your database product’s user documentation for instructions on how to back up your data.

Logging In

Log in as Tinker Boris:

After a moment, the DirX Audit Manager displays its main page. (See "About the Main Page Layout" in the DirX Audit Manager Guide for details.)

By default, DirX Audit Manager uses the language selected in the browser. If you want to change the display language you can do so in the application menu by changing the Core settings.

Analyzing Aggregated Data with the Dashboard

This exercise demonstrates the Dashboard feature of DirX Audit. We’ll explore how to:

  • Create your own Dashboards

  • Modify Dashboards and dashlets

  • Use default Dashboards

Creating a new custom Dashboard

We will start by creating a new custom dashboard in which to display the selected dashlets:

  • Click the Dashboard tile if it’s not already selected. This opens the Dashboard page with the selected Empty (Default) dashboard.

  • We will use the Empty (Default) dashboard as the basis for a new dashboard. It is the one that is displayed by default for all users even if no other favorite dashboards are not selected. Alternatively, you could also use one of existing product dashboard and delete the dashlets that you do not need. In order to display product dashboards it is necessary to have them marked as favorite. We will explore them later on.

  • Click Save as to create a new private dashboard. Add you name and description and then confirm the dashboard creation by clicking Create. This way a new private dashboard is created - it means that the current user can edit it (unlike existing product dashboards) and also nobody else will see it. It is displayed in the View list with the name you have chosen.

  • Click Add dashlet, select the Total audit events by month and source dashlet definition, click Next and then confirm adding the new dashlet by clicking Create. This results in adding a new dashlet into the dashboard display pane of the previously empty dashboard.

  • You can enlarge the new dashlet by dragging its outline to match your expected dashboard layout. You can resize any dashlet in order to customize your desired dashboard layout. A new dashlet can be added to the dashboard when there is at least 1 free space cell available in the dashboard display pane. If there is no free space avaiable a warning message is displayed instead.

  • The dashboard does not currently show any data because of the default time setting to display only the data from the current year.

  • In When, select Any time. This sets the dashboard time filter to display all data without any time limitation.

  • Click Add dashlet again to add the DirX Identity total audit events on accounts by month and operation dashlet, again by selecting it from the dashlet definition list, click Next and then confirm adding the new dashlet by clicking Create. Now we have 2 dashlets in the dashboard. You can adjust the dashlet size.

  • You can populate the layout with the other dashlets but you’ll use specific dashlets in subsequent tutorial steps.

  • Click Save changes to the view to save the dashboard modifications.

Using the Total Audit Events by Month and Source dashlet

The sample database contains a set of audit events collected from DirX Access and DirX Identity. We’ll have a look at their representation in the chart form. In the Dashboard view, look at the chart that displays the Total audit events by month and source dashlet.

The chart shows a list of months. There is a stacked bar for the month of October and single bar for the month of September. Pieces of the bar represent audit sources like DirX Access and DirX Identity and the total number of these operations over objects. You can read the total number figure from the chart or by moving the mouse over a bar and displaying its tooltip. For example, DirX Identity produced 220 audit events in September 2025 and 1012 audit events in October 2025.

  • Click the Maximize Maximize icon button in the dashlet Toggle menu (3 dots) to maximize the dashlet. The dashlet now takes over the entire Dashboard view display.

  • Click the Restore Restore icon button in the Toggle menu to return to the full dashboard and to show all dashlets again.

You might have noticed other options in the dashlet Toggle menu - Save as image and Report. You can try them to export an image or a full report of the selected dashlet. It is also possible to create a report of the full dashboard using the Report button in the top right corner of the dashboard.

Using the DirX Identity Total Audit Events on Accounts by Month and Operation dashlet

Now analyze operations over accounts:

  • Look at the Total audit events on accounts by month and operation dashlet displayed in the Dashboard view. The chart shows a list of months. There is a stacked bar for each of them this time. Pieces of the bar represent the following operations: Add Object, Delete Object, Disable, Enable, Update Object and the total number of these operations over account objects. For example, the Add Object operation was run 63 times in October 2025.

  • Click on Add Object in the bottom legend area. You’ll notice that the color next to the Add Object legend item changes to grey and the respective bar disappers from the chart. This way you can use additional ad-hoc filtering to disable dimensions or facts that for example take too much space in a dashlet and focus on smaller data.

Changing Dashlet Settings

We may also want to change a dashlet’s settings: its filters, data set and the style in which the data is displayed. The next exercises demonstrate how to accomplish these tasks.

Changing Dashlet Data

First, change the time constraint of the source data:

  • Choose a dashlet you want to change; for example, the DirX Identity total audit events on accounts by month and operation dashlet.

  • Click the dashlet Toggle menu and select Dashlet settings open the editing dialog.

  • Click the Filter by parameters menu and select Date and time in the list. This opens a subsection with the time filter below.

  • In the When filter, select Custom time.

  • Set 9/1/2022 12:00:00 AM to From and 9/30/2022 11:00:00 PM to To using the calendar pop-up menu.

  • Click Update. The chart is recalculated and the chart’s subtitle indicates the time frame you have just applied. You cannot see October 2025 data in this dashlet now because it is out of the changed time scope. You can notice that the modified time filter is also reflected in the dashlet title - (When: Custom time) is added at the end.

  • To revert this time constraint open the dashlet Toggle menu and select Dashlet settings again.

  • Click the Filter by parameters menu and now deselect Date and time in the list.

  • Click Update. Now all data is visible again.

We can also change the way the time dimension is displayed. Let’s try that.

  • Click the dashlet Toggle menu and select Dashlet settings open the editing dialog again.

  • Now scroll down to the Dataset section.

  • Click the Category expression (Dimension) and select Date and time in the list. This will change the displayed dimension from months to day.

  • Click Update. The chart is recalculated and displays more rows now, each representing a day in which respective events took place.

Changing the Dashlet Style

Now modify the dashlet style:

  • Choose a dashlet you want to modify; for example, the Total audit events by month and source dashlet.

  • Click the dashlet Toggle menu and select Dashlet settings open the editing dialog.

  • Scroll down to the Chart settings section.

  • Click the drop-down arrow in Theme and then select another color option than the one already selected.

  • Click Update. The chart is reset and a different color scheme is applied.

  • Click Save changes to the view to save the dashboard modifications performed in the previous exercises.

Using Default Dashboards

DirX Audit comes with a set of default dashboards with predifend dashlets. They are named to reflect the type and the content of dashlets they include.

  • If you want to use the provided product dashboard views you have to click the Manage views icon, switch to the Product tab, select the product views you want to work with - all of them for the purpose of this exercise - and click the Add to favorites icon. When you return to the Dashboard page the selected product views will be available in the View list.

  • Select the Accounts and Memberships dashboard in the View list. You can see that it contains several dashlets with a common topic - group memberships and user accounts both from the events and history data sources.

  • Click the Dashboard settings button next to the View list. In the settings menu, uncheck the Adjust layout to screen size option and confirm it by clicking Update. *You can now see that the dashboard does no longer fit into a single page but it was transformed into a longer and scrollable page. This view might be useful if you want to compare multiple dashlets without maximizing them one by one.

All the provided product dashboards are the following:

  • Accounts and memberships

  • Approvals

  • Authentications and authorizations

  • Certifications

  • Overall

  • Password changes

  • Provisionings

  • Users

Analyzing Audit Events with the Audit analysis

This exercise demonstrates how to use the DirX Audit Manager Audit analysis page. The Audit analysis provides a view on audit events in a user-friendly form. It extends the audit message data with three additional columns: Operation, Type and Detail. Information is digested from fields of the related audit message when the message is persisted into the DirX Audit Database. Each audit message can have no related audit events, exactly one related audit event, or more than one related audit event.

In this section, we’ll demonstrate how to:

  • Search for and analyze events

  • Work with event search filters

  • Create an audit events report

Searching and Analyzing Events

We’ll begin this exercise by opening the Audit analysis:

  • If you are not logged in to DirX Audit Manager, follow the instructions in "Logging In".

  • In the DirX Audit Manager main page, click the Audit analysis tile.

  • In When, select Any time.

  • Click Search.

The result is a table with 10 rows that represent audit events. The additional rows at the top and bottom of the table define column names.

Searching for an Operation

Now we’ll look at all events of a specific operation; in this case, the Add Assignment operation:

  • Add the Source filter by checking it in the Select filters menu. In Source, select DirX Identity.

  • In Event Operation, type Add Assignment.

  • Click Search.

Test this query with other operations; for example, Accept and Reject.

Analyzing the Audit Event Details

Now you can explore the details of the audit message using the Add Assignment operation:

  • In the result table, click the Show details zoom in icon icon in the Actions column to view additional information about the selected audit event.

The Event details will be displayed. You can see Audit Event, Identification, What, Who, Where From and Original Message sections.

Analyzing the Related Events

You can also explore the related events using the Add Assignment operation:

  • Click the Show related events work icon icon in the Actions column to display a list of audit events related to the selected one. The other messages are related to the original one, which means they caused it or they were caused by the original action.

Working with Views

This exercise demonstrates how to work with event search filter views: we’ll use the filter definition area in Audit analysis to create a private view modify it and then delete it.

Creating a Private View

You can save your search criteria as a view so that you can easily repeat common queries; here, you’ll create one for the User to Role Assignment event:

  • In Source, select DirX Identity.

  • In Event Operation, type Add Assignment.

  • In Event *Type, type User to Role.

  • Click Search to check what your selected filtering options will display.

  • Click Save as….

  • The Save view as pop-up window opens. In Name, type User to Role Assignment.

  • In Description, type User to role assignment from DirX Identity audit events.

  • Click Create.

You have just created a private view with a filter definition that searches for User to Role Assignment events from DirX Identity. Private filter views are available only to the user who created them. When you select it from the View list, the search fields are pre-filled with your saved search criteria and the search action is performed automatically.

Modifying a Saved View

You can change the search criteria of your saved view:

  • In the View list section menu, select the new private User to Role Assignment view in not already selected.

  • Add the Who name filter by checking it in the Select filters menu. In Who name, type DomainAdmin.

  • Click Search to check what your updated filter will display.

  • Click Save changes to the view.

Your view definition is now changed. You can also modify the filter’s name and description:

  • Click the Manage views settings icon icon to open the view manager.

  • To edit view properties select a view and click the Edit edit icon icon in the Actions column for User to Role Assignment.

  • In Name, type User to role assignment by DomainAdmin.

  • In Description, type User to role assignment from DirX Identity audit events caused by Domain Admin.

  • Click Update.

The view’s name, description and search criteria are changed.

Deleting a Saved View

You can delete a filter in the following way:

  • Click the Manage views settings icon icon to open the view manager.

  • Select the User to Role Assignment by DomainAdmin view.

  • Click the Delete delete icon icon in the Actions column. Confirm the deletion in the pop-up dialog.

  • Click Back to return to the Audit Analysis view.

If you have Audit Administrator rights, you can use the steps shown here to create, modify and delete public filters visible to other users. A private filter can be used, modified and deleted only by its owner. Public filters created by the Audit Administrator can be used but not deleted by an Auditor. The Audit Administrator is permitted to delete his private filters and public filters.

Using Additional Search Filters

Sometimes the search need to narrowed down by using various filters which provide more options for querying audit events. In this exercise, you will search for self-assisted password settings:

  • Delete your previous search criteria from Operation and What Type fields. To remove a value, simply click the Remove Remove icon icon next to it. The fields should be empty. You can also clear the fields by selecting the default Last 24 hours (Default) filter from the view selection above the search criteria fields.

  • Add the Event Dimension filter by checking it in the Select filters menu.

  • Click the Event Dimension field and select Password self assisted.

  • Click the new filter Password self assisted that appears next to the original Event Dimension field and select Assisted. See the section "Dimensions" in the chapter "Dashboard Data" in the DirX Audit Administration Guide for details.

  • Click Search.

You can see the list of events generated by assisted password settings in the connected systems and in DirX Identity Web Center. The changes were provided by domainAdmin (the Who search criterion).

Creating an Audit Events Report

When you perform a search, you can use the Report function to export the displayed result audit events:

  • Use the values returned from previous exercises or provide a search according your criteria.

  • Click Report. A pop-up window opens.

  • In Template, keep the Standard preset.

  • In Style, select a report color scheme of your choice or keep the default DirX Audit Deep blue.

  • In Format, select PDF.

  • In Action, you can choose if you want to download the exported file or directly open it in the browser.

  • Click Export.

A new tab opens with the exported report containing audit events from the currently displayed page.

Analyzing History Data with the History View

The History view works directly with history entries stored in the DirX Audit Database. As part of preparing to run this tutorial, you loaded sample DirX Identity history data generated from running the DirX Identity tutorials into your DirX Audit History database. In this set of exercises, you’ll learn how to use DirX Audit Manager History view to explore this sample data. For details on the DirX Identity tutorials on which these exercises are based, see the DirX Identity Tutorial.

In this exercise, you’ll learn how to:

  • Generate a table of history entries

  • Create a report of history entries

  • Search for user history entries by name and by distinguished name

  • Explore the details of a history entry

If you haven’t used the History view before, we recommend reviewing the information about its basic functions presented in the chapter "Using the History View" in the DirX Audit Manager Guide before continuing with this exercise.

Generating a Table of History Entries

To get started, you’ll use the DirX Audit Manager History view to generate a table of history entries for DirX Identity events:

  • If you aren’t logged in to DirX Audit Manager follow the instructions in "Logging In".

  • In the DirX Audit Manager main page, click the History tile.

  • Leave the default values in When (Any time), Type (User), and Attribute (uid) and then click Search.

DirX Audit Manager displays a result table below the search area that lists all of the matching entries. Each row represents one history entry that matches the search criteria. In our example, the result table shows ten users and a total of 109 users found.

Creating a History Report

Sometimes you may want to save your history entry result tables outside of DirX Audit Manager. To accomplish this task, you use the Report feature in DirX Audit Manager History view to save the result table to a formatted file. To save the result table you just generated:

  • In the History main page, click Report. A pop-up dialog appears with parameters for setting the output format.

  • Leave the default values as they are, and then click Export.

The reporting feature demonstrated here is a simple way to export on demand the search result lists generated from your current search criteria. You can read more about this feature in the section "Exporting History Entries" in the chapter "Using the History View" in the DirX Audit Manager Guide.

DirX Audit Manager Reports view provides a more powerful, complex mechanism for generating auditing reports both on demand and according to a schedule. We’ll demonstrate how to use this feature later on in this tutorial.

Searching for a User’s History

There are several ways to search for a history entry. You can use a specific attribute and its value or search for a history entry by its name, DN or dxrUid. We’ll show you how to use two of these methods in this exercise.

Searching for a User Entry by Name

First, we’ll search for a user history entry by its name. In this case, we’ll search for a history entry for the user Taspatch Nik:

  • In Type, select User.

  • In Name - starts with, type Taspatch and then click Search.

Because there is only one history entry in the sample database with the name Taspatch, DirX Audit Manager displays the details page for this entry.
We’ll explore the details page in more detail in a later exercise. For now, click Switch to search form to return to the History view main page.

Searching for a User Entry by DN

Now we’ll search for Taspatch Nik using his distinguished name (DN):

  • In Type, select Any.

  • Clear Name - starts with.

  • Add the Dn filter by checking it in the Select filters menu.

  • In Dn - ends with, type cn=Taspatch Nik,ou=Global IT,o=My-Company,cn=Users,cn=My-Company.

  • Click Search.

Because DirX Audit Manager finds only one entry with this DN, it displays the details page for this entry. In the next exercise, we’ll explore this details page.

Exploring History Entry Details

In "Searching for a User’s History", you searched for and retrieved a unique history entry for Nik Taspatch. Because it’s the only history entry for this user, DirX Audit Manager automatically displays its details page with the Attributes tab table open by default. You can also use the Show timeline button to switch from the table view to the graphical chart representation. It is especially useful for examining and comparing attribute time validity.

The Attributes tab table shows the list of attributes and their values depending on the selected comparison time point. In our example, the two time points are automatically selected and you can see the attributes and their values at each time point. Attributes that have changed are highlighted in yellow.

There are also other tabs next to Attributes: Events, Roles, Permissions, Groups, Accounts, Risks and Assignment cause each with a number showing the number of entries they contain.

Check the Changes only switch. Now you only see the changed values in the Attributes tab table for Nik Taspatch. The same functionality is available in other tabs as well.

Exploring a Role’s History

Now you’ll explore the history of one of the roles assigned to Nik Taspatch: the Internal Employees role.

  • Click the Roles tab. DirX Audit Manager displays a table with the names of the roles assigned to Nik Taspatch, the date of their validity and their assignment mode. In the table, you can see that:

    • The role Internal Employee has been assigned based on a rule.

    • The role DXR User Administrator has been assigned by inheritance from a business object.

    • The other roles have been assigned manually.

  • In the Role Name column, click the zoom in icon icon next to Internal Employee [rule]. This action directs you to this role’s details page with the Attributes tab table open by default.

  • Examine the Internal Employee role to view the event markers indicating the users that have been assigned to the role within the two comparison time points.

  • Click the Users tab. DirX Audit Manager displays a table that lists the names of these assigned users. You can use the Show timeline button to switch from the table view to the graphical chart representation.

Next, you’ll explore the user changes step by step:

  • Remove the first time point by opening its Toggle menu next to its date and time and select Remove time point. Add a new time point using the + button and set its date and time to 9/25/2022 12:00:00 PM.

  • Check Changes only. Now you can see the the names of the users who were assigned to the role in the process of following the exercises in the DirX Identity tutorial.

  • Click the Attributes tab and then uncheck Changes only.

  • Now examine the value of the dxrRoleAdmin attribute. You’ll see that Taspatch Nik is listed as a value. This means that Nik Taspatch was assigned to the role when it was created and that he is the role’s administrator.

Exploring a User’s Account History

Next we’ll examine Nik Taspatch’s account assignments. To return to Nik’s details page from the Internal Employee role details page, you can either:

  • Click the Taspatch Nik value for dxrRoleAdmin in the Attributes tab table (the highlighted and underlined text).

  • Click the Back button which will navigate you to the previously displayed history entry.

DirX Audit Manager returns to the details page with the Attributes tab table open by default.

Click the Accounts tab. The table shows the names of the accounts created for Nik Taspatch and the corresponding target system name.

Click the expansion arrow next to the account name Nik Taspatch 5326 (valid for Extranet Portal target system). You can see values for account state, target system state and login name.

Exploring Related Events for a User

Now you’ll look at the events related to Nik Taspatch’s history entry:

  • Click the Events tab.

  • Examine the Search in field. If it’s not already selected, select the What value from the list. Notice that there are no events for What that contain Taspatch Nik because there were no changes to any of the audited attributes for the user Nik Taspatch processed in the sample data from the DirX Identity tutorial run.

  • Go back to the Search in field and then select the Who value from the list. Now 41 events are shown because Taspatch Nik was the requester and/or the workflow approver of changes for other users during the DirX Identity tutorial run. You can learn about the details of these changes by reviewing the DirX Identity Tutorial exercises.

You’ve completed the initial exercises for learning how to use the History view. You’ll find more exercises on browsing audit history in the chapter "Identity Auditing".

Setting up Reports with the Reports View

DirX Audit Manager Reports view allows you to create various reports on events and history and then send them to selected recipients as email attachments. In this section, we’ll demonstrate these tasks.

To get started with this exercise:

  • If you are not logged in already, follow the instructions in the "Logging In" section to log in to DirX Audit Manager.

  • In the DirX Audit Manager main page, click the Reports tile.

Next, you’ll learn how to:

  • Work with report sets and report files

  • Schedule reports for email delivery to recipients

Working with Report Sets

When you want to create and send a report, you need to create a report set first. A report set contains one or more report files, which are represented by separate email attachments in the generated email message. These files in turn contain one or more reports selected from the list of available reports. Note that you must restrict yourself to using PDF for your reports if you want to create a report file with multiple reports. Other formats don’t support this feature.

In this exercise, you’ll learn how to:

  • Create a report set

  • Add a report file to a report set

  • Add a report to a report file

You can read more about how to work with report sets, report files and reports in the chapter "Using the Reports View" in the DirX Audit Manager Guide.

Creating a Report Set

First, you’ll create a new report set named Demo report:

  • Click the Add a report set Reports – Add a report set icon to create a new report set.

  • In Name, type Demo report. In Description, type Demo report set with two files. Using these fields makes it easier to identify report sets when they are displayed in the report set definitions table in the Reports view.

  • Click Create.

The report set you just created is now listed in the report set definitions table on the Reports main page.

Adding a Single Report File to a Report Set

Now you’ll add a report file that contains one report to the report set you just created:

  • Click the Edit Reports - Edit selected icon in Demo report in the list. This action opens the Edit report set dialog.

  • Click the Add a new report file Reports – Add a report file icon to add a new report file. This action starts the report file creation, which displays a list of available report file templates.

  • You can use Name or Tags to filter the list of report file templates. Type Event in Tags. Now only the reports with the Event tag are displayed.

  • Click on Changes on User to Privilege Assignments by User to select it in the list. The wizard opens the Report scope dialog, which allows you to define your report file’s parameters.

  • In the When section, select Any time.

  • In the Users section, specify the users whose data you want to view. In the first field (Attribute), select Name and then click Search. In the list of users in the Found table, check the boxes next to Bader Hans and Baretti Franca, and then click Add. These users are now shown in the Selected table.

  • In the second field (Value), type Teacher Mark and then click Search. Now check the box next to Teacher Mark (ou: Professional Services, o: My-Company, alt: 83730) and then click Add. Teacher Mark is now shown in the Selected table.

  • Click Create to complete the report file definition.

  • Now type Changes on User to Privilege Assignments by User - Bader Hans, Baretti Franca and Teacher Mark in File name. This file name will be displayed in the email as the name of the attachment and will also be displayed in the report set File tab.

  • Next, type User to Privilege Assignments by 3 users, pdf file format in Description.

  • Click Create. The report file is inserted into the report set and is displayed in the file list.

  • You can click Export to check the results of your filtering criteria for the configured report. A pop-up window opens with the preview report. In this example, clicking Export helps you to determine that there are no access requests events for Baretti Franca in the sample data set.

  • Click Create to save your changes to the Demo report report set.

Adding a Multi-Report File to a Report Set

In this exercise, you’ll add another report file to your report set. This report file contains two reports, which will be collated into one email attachment later on.

  • Click Reports – Edit selected in Demo report in the list. This action opens the Edit report set dialog with the File tab open by default.

  • To add a new report file for the report set, click the Add a new report file Reports – Add a report file icon in the Files tab header of the Report set page.

  • Use Name to filter the list of report file templates: type Logins in Name. Now only the reports that contain Logins in their names are displayed.

  • Click on the Total Sum of Logins report in the list to select it.

  • In When, select Custom time From 01/09/2025 To 31/10/2025.

  • In the Source section, define the source for the data you want to see. In the Identifying Attributes field is selected Name and you can click Search. In the Found table, check the box next to DirX Identity and then click Add. DirX Identity is added to the Selected table.

  • Click Next report. This action allows you to insert another report into the file.

  • Clear Tags. In Name, replace Logins with Assignments. You now see only those reports whose names contain assignments.

  • Click State of Assignments by User to select it in the list.

  • In the When section, select End of Previous Month.

  • In the Users section, define the source for the data you want to see. In the first Identifying Attributes field, select cn and then click Search. The Found table displays a long list of users.

  • In the Attribute Value field, type Abele and then select Abele Marc from the list. Now click Search. You can see Abele Marc in the Found table. Check the box next to the entry and then click Add. This user is added to the Selected table.

  • In the Attribute Value, type Teacher Mark and then follow the same procedure as with Abele Marc to add Teacher Mark to the Selected table. Now search for Berner Hans and Taspatch Nik and then add them to the Selected table.

  • Click Create to create the report file with two reports.

  • In Name, type File combines two reports in one attachment.

  • In Description, type Logins for DirX Identity, Assignments by user for Abele Marc, Teacher Mark, Berner Hans and Taspatch Nik.

  • Click Create. The report file is inserted into the report set and is displayed in the file list. You can see two different reports under the file you just added, which means that these two reports will be collated in one email attachment.

  • Click Create.

Sending a Report Set

Next, we’ll demonstrate how to schedule and send a report set. You’ll learn how to:

  • Schedule a report set for immediate delivery

  • Activate a report set so that it runs

  • Schedule a report set for generation and delivery

Scheduling the Report Set for Immediate Delivery

We want to send the reports in our report set right away so that we can review them, so we’ll set up a schedule for sending the report set immediately:

  • Click Reports – Edit selected in the Demo report set row to open it for editing.

  • Click the Schedule tab and then select As soon as possible.

  • Check No end time. (When this box is not checked, you can define an end date after which the report is no longer sent.)

  • Click the Send to tab and then enter your email address in To.

  • In Subject, type Demo report set.

  • Type the message text in Body. For example, Report set generated from DirX Audit. The attachment contains two files. In the file Changes on User to Privilege Assignments by User - Bader Hans, Baretti Franca and Teacher Mark there is a report Changes on User to Privilege Assignments by User. In the file named File combines two reports in one attachment there are Logins and Assignments by user.

    You can also leave the Body empty. The report status and description are then automatically added to the email message.

  • Click Update.

Activating the Report Set

Even when a report set is planned to be sent and email fields are populated, the report set will not be processed if it’s in the inactive state. In this exercise, you’ll switch your Demo report set to the active status to send it right away:

  • An inactive report is identified by the Reports – Activate selected icon in the first column of report set list. Click the inactive icon for the Demo report set to activate it.

  • The icon changes to Reports – Deactivate selected icon to mark the report set as active. If it has got a simple schedule it will be deactivated again after its execution.

  • If you set up the SMTP email server correctly during DirX Audit configuration, you will receive the email with the report attachment. For the As soon as possible scheduling option, the report is sent only once after each editing and saving.

Scheduling the Report Set for Regular Delivery

As an auditor, you probably want to generate and send your reports on a regular basis; for example, at the end of each month.

To be able to see variable data, choose a dynamic time definition in the When report scope for the reports in a report set, and then set the report schedule to run regularly. This section shows how to make these changes for the Demo report set we created earlier in this exercise. First, you’ll edit the report set and change the scope for the reports it contains:

  • Click Edit in the Demo report row to open the report set for editing. You’ll see two report files. One of them is the multi-report file named File combines two reports in one attachment with two reports listed underneath it. Click Edit report next to Total Sum of Logins to open it for editing. In the report scope dialog, change When to Previous Month.
    Click OK.

  • Perform the same steps for the other report file Changes on User to Privilege Assignments by User - Bader Hans, Baretti Franca and Teacher Mark to change the When scope to Previous Month for the report it contains.

Next, edit the report set and schedule it to run on a regular basis:

  • Click the Schedule tab and then select Recurring.

  • In Start date, select today’s date. Set Time to run for five minutes from now.

  • Change the End date to one month from today. The email and report will not be generated after this date.

  • Set Frequency to Monthly.

  • Select today’s date in Day of month so that you’ll see the generated email immediately.

  • Click Update.

After the DirX Audit Server synchronizes these changes, you can see that your report has the active status and that the Next start date column contains a date and time.

We’ve now finished the introductory exercises for how to view and manage reports with DirX Audit Manager. The exercises in "Identity Auditing" demonstrate more report features and describe individual report content.