Using Audit Analysis

The layout of the Audit Analysis page is shown in the following figure.

As shown in the figure, the Audit Analysis page consists of two main areas:

The filter definition area allows you to define search criteria for retrieving audit events from the DirX Audit Database. You can filter events based on various attributes. To exclude an attribute from the filter, simply leave its field empty.

Start by selecting a view, which loads a predefined set of filters. The default view is Last 24 hours (Default), which filters events from the last 24 hours. For more on managing views, see “Managing Audit Events Filter Views” or see “Managing Modifications in Views” for how to save or discard your changes to the view.

The default view contains the following filter fields:

DirX Audit Manager queries the database and displays a list of available attribute values from which you can make a selection. If the application encounters a problem while querying the database, for example due to a connection issue, a red exclamation icon is displayed next to the field description. It notifies the user that the data may not be available or up to date.

Use the Select filters to add more filter fields. The following additional filter fields are available:

For better readability, you can collapse the filter definition area by clicking the Collapse icon in the upper-right corner.

For the Source, Event Operation, Event Type, Outcome, and Identification Type filter fields, you can either select values from a predefined list or begin typing to search for matching values. As you type, DirX Audit Manager queries the database and displays a list of matching attribute values, from which you can select.

These fields support multiple values, allowing you to add several filter criteria for a single field. To remove a value, simply click the Remove icon next to it. If you no longer want to use a particular filter, you can remove it entirely from the list.

In the Event Operation, Event Type, Who Name, and What Name fields, you can search using a “Starts with” comparison. For example, entering Account in the Event Type field will return events related to Account and Account to Group memberships. These fields also support multiple values. Simply type a value and press Enter to add it. To remove a value, click the Remove icon next to it. If you no longer wish to use the filter, you can delete it from the list.

For the Event Dimension and Message Dimension filter fields, you can select a dimension from the available list. Once a specific dimension is selected, an additional field appears where you can choose a corresponding value. If you prefer not to filter by a specific value, simply select the empty line from the list. In this case, the search will return all events that include the selected dimension, regardless of its value.

To remove all values from a specific filter field, click the Remove all icon at the end of the line. This action deletes both the filter values and the filter field itself. To use the filter again, reselect it from the Select filters list.

To remove all filter fields from the filter definition area, click the Remove all icon next to the Select filters dropdown. You can re-add any filters as needed from the same list.

Click Search to execute your query. DirX Audit Manager will populate the search results area with audit events that match your criteria. For details on working with the results table, see “Viewing the Audit Events Search Results”.

You can also refine your search directly from the results: click on a value in the table to add it as a filter, then click Search again to update the results.

To export the search results to a file, click the Report button. For more information, see “Exporting Audit Events”. To schedule a report set based on the data searched using your view with filters set, click the Report button and follow information in the “Scheduling Audit Events Report” section.

You can name and save your custom filter views to the configuration database for future use. This allows you to quickly reapply commonly used filters without redefining them each time. Simply select a stored view from the View list and click Search.

Audit Analysis views are organized similarly to other views in DirX Audit Manager. For more details on using and managing the views, see “Managing and Understanding Views”. For more information on how to save or discard your changes to the view, see “Managing Modifications in Views”.

The search results display area presents audit events in a table format based on the criteria defined in the filter definition area.

Each search result includes the following features:

Note: If audit message data has been purged from the DirX Audit Database, some additional information or the original message may no longer be available in the Event Details window. Similarly, if related audit messages have been purged, the list of related events may be incomplete.

The page navigator, located at the bottom of the search results display area, allows you to control how results are displayed and navigate through multiple pages of items.

It includes the following elements:

The results table in the Audit Analysis view displays only a subset of the available audit event data. To view the full details of an audit event, click the Show details icon in the Actions column of the corresponding row. This action opens a window displaying all available information related to the selected audit event. The following figure illustrates an example of the detailed audit event view.

The detailed view includes several expandable sections, each providing specific information about the selected audit event:

The Audit Event bar is expanded by default for readability. Click any title bar to expand or collapse its section. Use the following icons in the upper-right corner:

To return to the Audit Analysis results, click the Back button or use the breadcrumb navigation.

If any field and its label are focused in the details view the Copy icon will appear and allow you to copy the field value to the clipboard for further use.

Some audit events include links to related history entries, marked with the See in history icon. Clicking the link, for example, on Briner Ruben, opens the corresponding history entry for further inspection.

To view audit events related to the selected one, click the Show related events icon in the Actions column of the results table.

DirX Audit Manager will search for and display all related audit events on a new page. These related events may include:

The related audit events are presented in the same format as the Audit Analysis results. To view more details about a specific related event, click the Show details icon. To return to the previous results list, click the Back button in the top-right corner of the page.

Note: If audit message data has been purged from the DirX Audit Database, some additional information or the original message may no longer be available in the Event Details window. Similarly, if related audit messages have been purged, the list of related events may be incomplete.

To export audit events displayed in the search results table into a report-formatted file, click the Report button in the filter definition area. The Events report dialog appears, allowing you to configure the export settings:

Click Export to generate the report containing the currently displayed data, or click Schedule to create a report set based on the data searched using your view with filters set. For more information, see “Scheduling Audit Events Report”.
Click Cancel to close the dialog without exporting.
After clicking Export you can choose either Download to save the report file directly or Open to open the generated report in a new browser tab. Your browser may prompt you to open, save, or cancel the download of the report file.

To schedule a report set based on the data searched using your audit analysis view with filters set, click the Report button in the filter definition area and follow the instructions in the Events report dialog.
It includes the same settings as described in “Exporting Audit Events” section.

The Schedule button in the Events report dialog is only active if you are working with a private audit analysis view. Otherwise, it is inactive so that the user cannot create a report set dependent on a public or product audit analysis view, which can be modified by another authorized user.

Click the Schedule button and choose either Add a new report set or an existing report set.
It opens a page with the report definition which contains the same settings for the report definition, template, style and record limit as in the Events report dialog and also shows your selected view with filters set.
If you chose Add a new report set confirming it will create a new report set containing a generated report file with the selected report definition. After filling in the report set name, or other values such as schedule, conditions or output, you can confirm report set creation.
In case you chose an existing report set, when you confirm creating the new report, you will be prompted to enter a name for the report file and it will be added to the selected report set.

If you activate your report set it will be executed according to the defined schedule. For more information on managing report sets, see “Using Reports” in this guide.