Audit Reports Permissions

The following permissions can be assigned to the auditing module to control access to the Reports console. For a group to manage auditing, the group also needs read permission to the auditing and authentication modules.

Descriptive Permissions

Allows users to...

All Permissions on audit reports

Have permissions to perform all operations. This implies you have “*” permission to audit reports.

View audit sessions and manage settings

View the Compliance Auditor console. This implies you have console permission to secaudit module.

View Reports Console

View the Reports console. This implies you have the console permission for audit module.

View audit sessions

Read the audit database. You must use console along with read. This implies you have read permission for audit module.

Create new audit reports and adjust filter settings in reports

Read and update the reports defined in the Reports console. This role is only useful when used in conjunction with the report permission.

View command control reports

Read and update the reports defined in the Reports console. This role is only useful when used in conjunction with the report permission.

View change log reports

View Account Logon reports. In conjunction you must use console and read permission. This implies you have logon permission for audit module.

View credential checkout reports

View Credential Checkout Reports. In conjunction you must use console and read permission. This implies you have console permission and read permission for audit module.

View shared key checkout reports

View Shared Key Checkout Reports. In conjunction you must use console and read permission

Access reports with the report defined roles

You can access relevant reports based on the roles.

View account logon reports in reporting (old UI)

View Account Logon reports.

View Command Control reports in reporting (Old UI)

View Command Control reports.

You can use these Audit Report permissions to create the following types of audit managers:

  • Administrator: To allow the group to update all aspects of the auditing module, including encryption and rollover, the group needs to be assigned the following permissions for the audit module:

    • admin

    • write

    • read

    • command

    • console

  • Manager: To allow the group to update all aspects of the auditing module, except encryption and rollover, the group needs to be assigned the following permissions for the audit module:

    • write

    • read

    • command

    • console

  • User: To allow the group to read and update a specific report, the group needs to be assigned the following permissions for the audit module:

    • command

    • console

    • report

    • <report defined read>

    • <report defined update>

    If you want the group to have read-only privileges to the report, do not assign the <report defined update> role. Users with read-only rights to a report can view the report from the console, view the keystroke sessions within the report, and select which audit databases to view (see the LogFiles tab). Users who also have the update right can update the report’s filter, its name, and its description.

    Each report allows you to specify a read role and an update role. You need to remember those names and manually specify them here. The console does not provide any error checking, so you need to ensure to specify the valid name.