Active Directory Reporting

Fortunately, there’s Quest^® Change Auditor. This product family enables you to audit, alert and report on all changes made to Active Directory (AD), Azure AD, Exchange, Offce 365, SharePoint, Skype for Business, VMware, EMC, NetApp, SQL Server and Windows file servers, as well as LDAP queries against AD - all in real time and without enabling native auditing.

You can easily install, deploy and manage your environment from one central console. Tracking creates, deletes, modifications and access attempts could not be any easier, and understanding what happened is a breeze because each event and all related events are displayed in simple terms, giving you the requisite five Ws - who, what, when, where and originating workstation, plus the previous and current settings.

This breadth of data analysis enables you to take immediate action when issues arise, such as what other changes came from specific users and workstations, eliminating additional guesswork and unknown security concerns. Whether you are trying to meet mounting compliance demands or satisfy internal security policies, Change Auditor is the solution you can rely on.

Features

Hybrid environment auditing with a correlated view - Audit hybrid environments, including AD/Azure AD, Exchange/Exchange Online, SharePoint / SharePoint Online / OneDrive for Business as well as AD logons and Azure AD signins.

Unlike native auditing, Change Auditor offers a single, correlated view of activity across hybrid environments, ensuring visibility to all changes taking place - whether on premises or in the cloud. Change prevention - Protect against changes to critical data within AD, Exchange and Windows file servers, including privileged groups, Group Policy objects and sensitive mailboxes.

Auditor-ready reporting - Generate comprehensive reports for best practices and regulatory compliance mandates for SOX, PCI DSS, HIPAA, FISMA, GLBA, GDPR and more.

High-performance auditing engine - Remove auditing limitations and capture change information without the need for native audit logs, resulting in faster results and significant savings of storage resources. *

Improved insights with Quest^® IT Security Search - Correlate disparate IT data from numerous systems and devices into an interactive search engine for fast security incident response and forensic analysis. Include user entitlements and activity, event trends, suspicious patterns and more with rich visualizations and event timelines.

Account lockout - Capture the originating IP address and workstation name for account lockout events, and view related logon and access attempts in an interactive timeline. This helps simplify detection and investigation of internal and external security threats.

Real-time alerts on the move - Send critical change and pattern alerts to email and mobile devices to prompt immediate action, enabling you to respond faster to threats even while you’re not on site.

Security timelines - View, highlight and filter change events and discover their relation to other security events in chronological order across your AD and Microsoft platforms for better forensic analysis and security incident response.

Related searches - Get one-click, instant access to information on the change you’re viewing and all related events, such as what other changes came from specific users and workstations, eliminating additional guesswork and unknown security concerns.

Event archiving - Schedule the archiving of older data to an archive database, enabling organizations to keep critical and relevant data online while improving overall performance of search and data retrieval.

Integrated event forwarding - Easily integrate with SIEM solutions to forward Change Auditor events to Splunk, HP ArcSight or IBM QRadar. Additionally, Change Auditor integrates with Quest^® InTrust^® for long-term 20:1 compressed event storage and aggregation of native or third-party logs to reduce storage costs on SIEM forwarding and create a highly compressed log repository.

Role-based access - Configure access so auditors can run searches and reports without making any configuration changes to the application, and without requiring the assistance and time of the administrator.

Web-based access with dashboard reporting - Search from anywhere using a web browser and create targeted dashboard reports to provide upper management and auditors with access to the information they need without having to understand architecture or administration.

“ Change Auditor has been a very intuitive, but very powerful, tool allowing me to have an understanding of the changes that staff are making. This has allowed me to enforce policies, restrict access and receive alerts concerning breaches.”
Senior IT Architect, Medium Enterprise
Professional Services Company
Source: TechValidate. TVID: B4A-A84-619

With Change Auditor, you’ll get the who, what, when, where and originating workstation of all changes, in chronological order, including correlated on-premises and cloud identities.

Benefits

Eliminate unknown security concerns, ensuring continuous access to applications, systems and users by tracking all events and those changes related to specific incidents.

Alleviate stress and complexity by automatically interpreting cryptic data and its severity for faster and better decision-making.

Mitigate security risks in seconds with real-time alerts to any device for immediate response, in or out of the office.

Reduce the performance drag on servers by collecting events without the use of native auditing.

Streamline compliance reporting, isolated for internal policies and external regulations, including SOX, PCI DSS, HIPAA, FISMA, SAS 70 and more.

Provide managers and auditors evidence of appropriate IT controls for peace of mind.