Page Comparison

• Introduction

• NetIQ Users report

• Content of NetIQ Users report

• Creation of report in the selected period of time

• Export and download of the results

• Reports schedule

• Group Membership report

• Working with the reports filters

• Real use case example

  • Further investigation

  • Investigation results

Hello. In this video we’re going to show you how to use ACDI reports to audit and monitor data and events in your directory.

...

Reports may be searched either by text or by name.

...

Let's start with the simplest report: NetIQ Users Report.

...

Every day or by using Cron, the Snapshot Service takes a snapshot of your eDirectory or Active Directory and stores the state of objects in Opensearch so that you can parse through it using ACDI.

...

The NetIQ Users Report contains only one entity, which is based on those snapshots—report default.

...

As for filters, Result Table Attributes, and Postprocessing, we’ll be coming back to these options of report editing in upcoming videos. Now, let's go back to the report.

...

This report will allow you to create reports and to see the current states of your user objects in the selected period of time.

...

Here you can see that during the selected period this user has the following attributes and “False” locked.

...

You can export report results into CSV, XLSX, or PDF format, which is extremely convenient.

...

The next step is to download the file so that you can later process the data using external applications.

...

Additionally, reports can be scheduled to be created when you need them. Here are the filters you selected at the previous step, namely, “Last Name” and “Date Time Range.

...

You can select the format here and also define emails to which this report will be sent. Save the settings, and the Expert Service will create this report and send it to you on a monthly basis.

...

Let's look at a more complex report like the Group Membership report.

...

In this list and in this search, you will get only groups that have at least one member.

...

The filter can be customized though.

...

Let’s enable the flat format and click “Run.” So now you have the data in the table in flat format.

...

Two previous reports were based on the data from snapshots. However, ACDI also contains reports based on audit events. Let's check a few of them and go through a real use case.

...

Here we can see that on the exact date someone changed the attribute “Login disabled” to “True” and then later the admin was enabled. And the report shows that the modifier of the incorrect event was a user with the CN “Valerius.”

...

You want to investigate further, don’t you? You want to know why and how Valerius got access and authorization to make changes for your users.

...

For this you can use the NetIQ Audit Groups where you enter “Admins” in the “Object Name” filter.

...

Here you want to get the information about all the changes in admins during the last seven days. Let's run the report.

...