Quest Change Auditor
About product
Event logging and change reporting for applications and services in the enterprise are cumbersome, time-consuming and, in some cases, impossible using native auditing tools. Because there’s no central console, you’ve got to repeat the process for each server, and you end up with a huge volume of data with no context and a myriad of reports.
That means proving compliance or reacting quickly to events is a constant challenge. Your data security is also at risk because native event details are sparse and diffcult to interpret. As a result, you may not find out about problems until it is too late. And because native tools cannot prevent a privileged user from clearing an event log, you could lose log data - defeating the purpose of auditing in the first place.
Active Directory Reporting
Fortunately, there’s Quest® Change Auditor. This product family enables you to audit, alert and report on all changes made to Active Directory (AD), Azure AD, Exchange, Offce 365, SharePoint, Skype for Business, VMware, EMC, NetApp, SQL Server and Windows file servers, as well as LDAP queries against AD - all in real time and without enabling native auditing.
This breadth of data analysis enables you to take immediate action when issues arise, such as what other changes came from specific users and workstations, eliminating additional guesswork and unknown security concerns. Whether you are trying to meet mounting compliance demands or satisfy internal security policies, Change Auditor is the solution you can rely on.
Features
Hybrid environment auditing with a correlated view - Audit hybrid environments, including AD/Azure AD, Exchange/Exchange Online, SharePoint / SharePoint Online / OneDrive for Business as well as AD logons and Azure AD signins.
Auditor-ready reporting - Generate comprehensive reports for best practices and regulatory compliance mandates for SOX, PCI DSS, HIPAA, FISMA, GLBA, GDPR and more.
High-performance auditing engine - Remove auditing limitations and capture change information without the need for native audit logs, resulting in faster results and significant savings of storage resources. *
Unlike native auditing, Change Auditor offers a single, correlated view of activity across hybrid environments, ensuring visibility to all changes taking place - whether on premises or in the cloud. Change prevention - Protect against changes to critical data within AD, Exchange and Windows file servers, including privileged groups, Group Policy objects and sensitive mailboxes.
Improved insights with Quest® IT Security Search - Correlate disparate IT data from numerous systems and devices into an interactive search engine for fast security incident response and forensic analysis. Include user entitlements and activity, event trends, suspicious patterns and more with rich visualizations and event timelines.
- Account lockout - Capture the originating IP address and workstation name for account lockout events, and view related logon and access attempts in an interactive timeline. This helps simplify detection and investigation of internal and external security threats.
- Real-time alerts on the move - Send critical change and pattern alerts to email and mobile devices to prompt immediate action, enabling you to respond faster to threats even while you’re not on site.
- Security timelines - View, highlight and filter change events and discover their relation to other security events in chronological order across your AD and Microsoft platforms for better forensic analysis and security incident response.
- Related searches - Get one-click, instant access to information on the change you’re viewing and all related events, such as what other changes came from specific users and workstations, eliminating additional guesswork and unknown security concerns.
- Event archiving - Schedule the archiving of older data to an archive database, enabling organizations to keep critical and relevant data online while improving overall performance of search and data retrieval.
- Integrated event forwarding - Easily integrate with SIEM solutions to forward Change Auditor events to Splunk, HP ArcSight or IBM QRadar. Additionally, Change Auditor integrates with Quest® InTrust® for long-term 20:1 compressed event storage and aggregation of native or third-party logs to reduce storage costs on SIEM forwarding and create a highly compressed log repository.
- Role-based access - Configure access so auditors can run searches and reports without making any configuration changes to the application, and without requiring the assistance and time of the administrator.
- Web-based access with dashboard reporting - Search from anywhere using a web browser and create targeted dashboard reports to provide upper management and auditors with access to the information they need without having to understand architecture or administration.
Benefits
- Eliminate unknown security concerns, ensuring continuous access to applications, systems and users by tracking all events and those changes related to specific incidents.
- Alleviate stress and complexity by automatically interpreting cryptic data and its severity for faster and better decision-making.
- Mitigate security risks in seconds with real-time alerts to any device for immediate response, in or out of the office.
- Reduce the performance drag on servers by collecting events without the use of native auditing.
- Streamline compliance reporting, isolated for internal policies and external regulations, including SOX, PCI DSS, HIPAA, FISMA, SAS 70 and more.
