Using Audit Analysis

The layout of the Audit Analysis main page is shown in the following figure.

As shown in the figure, the Audit Analysis page consists of two main areas:

The filter definition area allows you to define search criteria for retrieving audit events from the DirX Audit Database. You can filter events based on various attributes. To exclude an attribute from the filter, simply leave its field empty.

Start by selecting a view, which loads a predefined set of filters. The default view is Last 24 hours (Default), which filters events from the last 24 hours. For more on managing views, see “Managing Audit Events Filter Views”.

The default view contains the following filter fields:

Use the Select filters to add more filter fields. The following additional filter fields are available:

For better readability, you can collapse the filter definition area by clicking the Collapse icon in the upper-right corner.

For the Source, Event Operation, Event Type, Outcome, and Identification Type filter fields, you can either select values from a predefined list or begin typing to search for matching values. As you type, DirX Audit Manager queries the database and displays a list of matching attribute values, from which you can select.

These fields support multiple values, allowing you to add several filter criteria for a single field. To remove a value, simply click the X next to it. If you no longer want to use a particular filter, you can remove it entirely from the list.

In the Event Operation, Event Type, Who Name, and What Name fields, you can search using a “Starts with” comparison. For example, entering Account in the Event Type field will return events related to Account and Account to Group memberships. These fields also support multiple values. Simply type a value and press Enter to add it. To remove a value, click the X next to it. If you no longer wish to use the filter, you can delete it from the list.

For the Event Dimension and Message Dimension filter fields, you can select a dimension from the available list. Once a specific dimension is selected, an additional field appears where you can choose a corresponding value. If you prefer not to filter by a specific value, simply select the empty line from the list. In this case, the search will return all events that include the selected dimension, regardless of its value.

To remove all values from a specific filter field, click the Remove all icon at the end of the line. This action deletes both the filter values and the filter field itself. To use the filter again, reselect it from the Select filters list.

To remove all filter fields from the filter definition area, click the Remove all icon next to the Select filters dropdown. You can re-add any filters as needed from the same list.

Click Search to execute your query. DirX Audit Manager will populate the search results area with audit events that match your criteria. For details on working with the results table, see “Viewing the Audit Events Search Results”.

You can also refine your search directly from the results: click on a value in the table to add it as a filter, then click Search again to update the results.

To export the search results to a file, click the Report button. For more information, see “Exporting Audit Events”.

You can name and save your custom filter views to the configuration database for future use. This allows you to quickly reapply commonly used filters without redefining them each time. Simply select a stored view from the View list and click Search.

Filter views are grouped into the following categories:

The default view is predefined for both Audit Analysis and History. If you remove it from your Favorites, the first view in the Favorites list becomes the default.

To save a new view, click the Save As icon next to the View field. Provide a name, a description, and select the visibility (Public or Private). Only users with the Audit Administrator role can create public views. Other users can only save views as private. Click Create to save the view.

To update an existing view, click the Save changes to the view . Only Audit Administrators can update public views. Product views deployed during the product installation cannot be modified.

To reset all changes in the selected view, click the Undo changes icon.

Click the Manage views icon to open the view manager. Here, views are organized into Favorites, Private, Public, and Product tabs. Click the Mark as favorite icon in the Actions column to appear the view in the Favorites tab and the View dropdown. Click the Remove from favorites icon in the Actions column to remove the view from the lists. In the Favorites tab, you can reorder views by dragging and dropping them.

You can also clone, edit, and delete existing views. These capabilities help tailor the filtering experience to individual or organizational needs.

The search results display area presents audit events in a table format based on the criteria defined in the filter definition area.

Each search result includes the following features:

Note: If audit message data has been purged from the DirX Audit Database, some additional information or the original message may no longer be available in the Event Details window. Similarly, if related audit messages have been purged, the list of related events may be incomplete.

The page navigator, located at the bottom of the search results display area, allows you to control how results are displayed and navigate through multiple pages of items.

It includes the following elements:

The results table in the Audit Analysis view displays only a subset of the available audit event data. To view the full details of an audit event, click the Show details icon in the Actions column of the corresponding row. This action opens a separate window displaying all available information related to the selected audit event. The following figure illustrates an example of the detailed audit event view.

The detailed view includes several expandable sections, each providing specific information about the selected audit event:

The Audit Event bar is expanded by default for readability. Click any title bar to expand or collapse its section. Use the following icons in the upper-right corner:

To return to the Audit Analysis results, click the Back icon or use the breadcrumb navigation.

Some audit events include links to related history entries, marked with the See in history icon. Clicking the link, for example, on Costello Marcella, opens the corresponding history entry for further inspection.

To view audit events related to the selected one, click the Show related events icon in the Actions column of the results table.

DirX Audit Manager will search for and display all related audit events on a new page. These related events may include:

The related audit events are presented in the same format as the Audit Analysis results. To view more details about a specific related event, click the Show details icon. To return to the previous results list, click the Back icon in the top-right corner of the page.

Note: If audit message data has been purged from the DirX Audit Database, some additional information or the original message may no longer be available in the Event Details window. Similarly, if related audit messages have been purged, the list of related events may be incomplete.

To export audit events displayed in the search results table into a report-formatted file, click Report in the filter definition area. The Events report dialog appears, allowing you to configure the export settings:

Click Export to generate the report. Click Cancel to close the dialog without exporting. After clicking Export, your browser may prompt you to open, save, or cancel the download of the report file.