All Command Control audit records contain the following information:
Submit details such as, the submitting username, hostname, and primary group.
Target details such as, the run username and the run hostname.
Command details, which include the original command requested and the actual command run.
Authorization status, either yes or no.
Session capture status, either yes or no.
Audit ID, which is the unique ID used to group audit events for the user’s session.
Codeset, which is the character encoding used for localization.
Terminal details such as tty name, terminal dimensions, and type.
The Audit Settings option allows you to modify this default record and add the following:
Encryption of sensitive password data in keystroke capture reports along with a password that allows authorized Framework administrators to decrypt it.
Additional options that can be audited for each record.
To define audit settings:
On the home page of the console, click Command Control.
In the command control pane, click Command Control.
In the details pane, click Audit Settings.
Configure the Password keystroke settings:
Select the Password filter check box.
In the Password filter text box, specify the text that is used to prompt users for their passwords.
For example, if the systems request a user’s password by using the word Password, specify Password in this field. If the systems use password, enter password in this field. This ensures that the password the user enters in response to this prompt is encrypted in the command control reports.
You can also use regular expressions as a password filter.
For example:
=~#([Pp]assword:)|(RDN:)#
This password filter would match Password, password, or RDN.
Select the Encryption password check box.
NOTE:If a filter is set and the Encryption Password is not set, then the filtered data is deleted from audit records.
In the Encryption password text box, specify the password that you require to decrypt the sensitive password data in the report.
This password must be entered on the Command Control Keystroke Report page under the Reports console to decrypt the password data.
Specify the password again in the Confirm password text box.
(Optional) Select the required check boxes under Metadata Audit Settings to add more information to the audit record:
Command: Complete information about the command being run, including the actual filename and arguments.
Host: Information about the submitting host
Environment: Complete list of the environment variables that are passed to the executed command.
Local time: The time on the machine that submitted the request.
Cwd: Details about the current working directory where the command was executed.
Options: Details about the various process control options for executing the command.
Run Account: Information about the account that is used to execute the command.
Process: Details about the process that submitted the request.
Jobs: The job control setting that were passed to the executed command.
Passwd: Details of the /etc/passwd entry for the user submitting the request.
Groups: The group membership details for the executed command.
Logon: The login time and source for the user submitting the request.
Click Finish.