Editing an Audit Record

For each event listed in the Compliance Auditor, you can edit the audit record to authorize the event, or mark it as unauthorized, escalate it, and assign it to another user. You can also add notes for display in the event record, and comments that are permanently recorded in the event history.

NOTE:For Command Control events for which a keystroke report exists, you must view the keystroke report before editing the audit record.

To edit an audit record:

  1. Click Compliance Auditor on the home page of the console.

  2. Select the record you want to edit.

  3. Click View Record in the task pane.

  4. Click Edit Record.

  5. (Optional) Authorize the event:

    1. Select the Authorized check box.

    2. In the Note field, specify a note to be displayed on the event list and event record.

    3. In the Comment field, specify a comment to be permanently displayed in the History on the View Record page.

  6. (Optional) Mark the event as unauthorized:

    1. Select the Unauthorized check box.

    2. If necessary, set an Escalation Level to be displayed on the event list.

      This can be used as a report filter when setting up reports. See Adding, Copying and Modifying an Audit Report.

    3. If necessary, use the Assigned to field to assign the record to a different user.

    4. Specify a Note or a Comment to explain why the event is unauthorized.

  7. Click Finish.