Click Compliance Auditor on the home page of the console.
Select the record you want to view.
Click View Record in the task pane.
Record data for this event is shown, including the submit user and host, the run user and host, the command, whether it was authorized by Command Control, and whether the session was captured.
From here you can view a Command Control keystroke report, if it exists, or edit the record. If a keystroke report exists, you must review it before you can edit the record. See Viewing and Editing a Command Control Keystroke Report for more information.
Click Compliance Auditor on the home page of the console.
Select the record for which you want to view a keystroke report.
Click View Record in the task pane.
Click View Keystroke Report in the task pane, or click the Keystroke button.
The text that the user entered during the session is shown on the Input page. The first column displays color-coded indicators for command risk level and rule risk level, ranging from green (low) to red (high). For more information, see Setting the Command Risk and Modifying a Rule.
On the Command Control Keystroke Report page, edit the following fields:
Terminal Type: Change the terminal type if it is set incorrectly.
Find: To find a specify command or string in the report, specify the text in the text box, then click Find.
Show control characters: Use the Show control characters check box to show or hide control characters on the screen.
Show audited commands: Use the check box to show or hide the full list of audited commands. If this option is enabled, the screen shows the actual commands that are being run when a user types a command. You can also view each input command individually by mousing over the command.
Show profile commands: Use the check box to show or hide the commands run in the user’s login profile when the user’s pcksh login shell has auditing configured to level 2.
(Optional) To see the keystroke text being played back with the screen output, click Output.
You can start the playback from a specific line in the input by selecting that line before clicking Output.
Click Play to play the keystroke entries and view the output.
Click Rewind to go back to the beginning.
Click Pause to pause the playback.
Click Forward to skip any pauses in the playback where the user might have taken a break from typing.
Set the Playback Speed to Real Time, Double Speed, or Full Speed.
Set the Scrollback field to the amount of text you want to be able to scroll back through, in kilobytes.
Change the Terminal Type to the one you want.
Click Cancel to return to the record list.
Click Compliance Auditor on the home page of the console.
Select the Command Control Change Management record you want to view.
The record type is shown in the Type column. You might need to scroll to the right to see this column.
Click View Record in the task pane.
Information about the Change Management action is displayed, including the name of the user who made changes to the database, and any entries the user made when committing the Command Control transaction.
To edit the record, see Editing an Audit Record.
Click Compliance Auditor on the home page of the console.
Click the record you want to view.
The record type is shown in the Type column. You might need to scroll to the right to see this column.
Click View Record in the task pane.
Record data for this report is shown, including the contents of the report sent.
To edit the record, see Editing an Audit Record.
For each event listed in the Compliance Auditor, you can edit the audit record to authorize the event, or mark it as unauthorized, escalate it, and assign it to another user. You can also add notes for display in the event record, and comments that are permanently recorded in the event history.
NOTE:For Command Control events for which a keystroke report exists, you must view the keystroke report before editing the audit record.
To edit an audit record:
Click Compliance Auditor on the home page of the console.
Select the record you want to edit.
Click View Record in the task pane.
Click Edit Record.
(Optional) Authorize the event:
Select the Authorized check box.
In the Note field, specify a note to be displayed on the event list and event record.
In the Comment field, specify a comment to be permanently displayed in the History on the View Record page.
(Optional) Mark the event as unauthorized:
Select the Unauthorized check box.
If necessary, set an Escalation Level to be displayed on the event list.
This can be used as a report filter when setting up reports. See Adding, Copying and Modifying an Audit Report.
If necessary, use the Assigned to field to assign the record to a different user.
Specify a Note or a Comment to explain why the event is unauthorized.
Click Finish.
Audit records can be archived from the console or from the command line. For information about the command line options, see Section 10.7.2, Managing Compliance Auditor Records.
To archive records from the console:
Click Compliance Auditor on the home page of the console.
Select the records you want to archive.
To select multiple records, press the Ctrl key and select the records one at a time, or press the Shift key to select a consecutive list of records.
Click Archive Records in the task pane.
A list of the selected records is displayed.
Configure the following fields:
Comment: (Required) Specify the reason for the archive.
Keep Online: (Optional) Select if you want the archived records to continue to be displayed in the list of records.
Configure the types of records to archive.
By default, authorized and unauthorized records are selected. New and pending records are not displayed. If you want to archive these records, select the New and Pending options.
IMPORTANT:After a record is archived, it cannot be modified. If you archive new or pending records, their status can never change.
Click Finish.
From the Framework Manager console, you can restore an archive and move archives from an online state (viewable in the console) and to an offline state (not viewable in the console) and from an offline state to an online state. You must use the command line options to purge an archive. See Section 10.7.2, Managing Compliance Auditor Records.
NOTE: When you archive secaudit events, the archived events are only stored on the primary secaudit manager and not on the backup secaudit manager. Back up these files for fault tolerance.
To manage archived records from the console:
Click Compliance Auditor on the home page of the console.
Click Manage Archives in the task pane.
To restore an archive to an online status, select the archive, then click Make Online.
To move an archive from an online status to an offline status, select the archive, then click Make Offline.
Click Close.
Live Risk view displays the hosts on which any malicious or risky activity was performed based on the configurations in the Compliance Auditor.
To view the hosts on which a malicious activity was performed, you must create corresponding audit rules in the Compliance Auditor.
You can click on the host that is displayed in the Live Risk view to view the complete audit details. When you click on the host in Live Risk view, it displays the corresponding Compliance Audit records, which can be used for further analysis of the malicious activity.
For more information about Deployment Dashboard, see Deployment Dashboard.
Click Compliance Auditor on the home page of the console.
Click Access Control in the task pane.
To add a new ACL, click Add User ACL in the task pane. To modify an existing ACL, select the required User and click Modify ACL in the task pane.
When creating a new user ACL, select the user from the Username drop-down list.
At the bottom of the table, select the attribute from the drop-down list that describes the entity to which you want to control access for the selected user.
For example, if you do not want this user to be able to audit Command Control events involving a particular command, click Command.
In the Matches field, specify the value of the attribute you want to control access to.
For example, if you do not want this user to be able to audit any Command Control events that involve SSH session, specify command <ssh> in this field. You can use wildcard characters in this field.
Set the Action to allow or deny.
Click Add.
(Optional) Use the arrow buttons to move entries up and down the list.
You might want to do this if, for example, you are allowing the user to access a restricted list of commands, and using the wildcard * to deny access to all other commands. The allowed commands entries must be above the deny all entry. By default, all commands are allowed.
(Optional) Remove an attribute by selecting it and then clicking the Remove button.
(Optional) Modify an entry by selecting it, then specifying the changes. Click Update to save the changes.
Click Finish.
Click Compliance Auditor on the home page of the console.
Click Access Control in the task pane.
Select the user for whom you want to delete an ACL.
Click Delete User ACL in the task pane.
Click Finish to delete the ACL for the user.