Custom Reports

Custom reports feature in ADAudit Plus, is in addition to the already available 200+ pre-configured reports. Users can now create numerous "exact" audit reports to suit their organization's need. The custom reporting ensures there is room for functionality and curtails reporting limitations; users can select preferred event filters from the all-encompassing reporting categories (7) with sub modules (30+) and event filtering options (50+) to choose from. These reports can be e-mailed as a compressed zip file, a link or as an attachment in any of the listed formats - pdf, xls, csv or html.

  1. How To Create a Custom Report

  2. How To View a Custom Report

  3. How To Edit a Custom Report

  4. How To Delete a Custom Report

The various functionalities that help you create a precise custom report

Create Custom Report

The very first step of creating a custom report, wherein you enter the report name, description & domain name.

Select Report Type

Select a report view type from Tabular, Graphical, Summary & Pivot (Matrix) view.

Select Category

Users can select from the 7 reporting categories which has 30+ sub modules and a further 50+ event filtering options to choose from.

Columns to be Displayed

Users can choose from a host of columns, to view the required audit data in the reports.

Filters

Numerous event filters (equals & not equals) conditions can be added here for the selected columns.

Charts

After choosing the report view type above, now select the chart type to suit your audit report type or your organization's preferred style.

Scheduler

The "Custom Report" can be scheduled on a 'Hourly', 'Daily', 'Weekly' or 'Monthly' basis. The scheduled report can be e-mailed to any email-id(s).

Privacy

An user can restrict, other from viewing the "Custom Reports" it can be set to just the administrator (creator) or everyone.


Create Custom Report

  • Click on the "Reports" Tab > "Custom Reports" on the right side > "Create Custom Report".
  • Enter the "Report Name" and the "Description" in the respective Text boxes.
  • Select the "Domain Name" from the Drop Down.

Select Report Type

ADAudit Plus allows you to select the default reports along with user defined reports and schedule it to be run at a specific time.

  • Tabular View: Tabular view provides you a way to list your values in a simple tabular format (Graph optional).
  • Graphical View: Graphical view allows you to create a graphical view using different types of charts.
  • Summary View: Summary view allows you to view data with grouping and subtotals.
  • Pivot(Matrix) View: Pivot view allows you to view data summarized in a grid both in horizontal and vertical columns.

Select Category

Shown below are the 7 custom reporting categories and their sub modules options, along with the 50+ report options.

Category

Sub Module(s)

Reports

Logon Activity

Logon Success | Logon Failures

Logon Failures
Bad user name | Bad password | Password has expired | New computer account has not replicated yet or computer is pre-w2k | Workstation/logon time restriction | Account disabled, expired, or locked out | Time in workstation is not in sync with the time in DCs | Administrator should reset the password on the account

File Activity

Files Created | Files Deleted | Files Modified | Files Read | File Move | Files Copy | Permission Changes | SACL Changes

AD Objects

User Management | Group Management | Computer Management | OU Management | GPO Management | Contacts Management | Container Management | Password Settings Changes

User Mangement
Users Created | Users Deleted | Users Enabled | Disabled Users | Locked out Users | Unlocked Users | Password Changed Users | Password Reset Users | Password Never Expired Users | Modified Users | User Attributes Changes | User Attribute New and Old Value | User Moved
Group Management
Security Group Created | Security Group Deleted | Member Added to Security Group | Member Removed from Security Group | Distribution Group Created | Distribution group Deleted | Member Added to Distribution Group | Member Removed from Distribution Group | Group Attributes New and old Value | Group Attributes Changes | Group Modified | Group Moved
Computer Management
Computer Created | Computer Deleted | Computer Modified | Computers Enabled | Disabled Computers | Computer Attributes Changes | Computer Attribute New and Old Value | Computer Moved
OU Management
OU Created | OU Deleted | OU Modified | OU Attributes Changes | User Moved
GPO Management
GPO Created | GPO Deleted | GPO Modified | GPO Link Changes
Contacts Management
Contacts Created | Contacts Deleted | Contacts Modified
Container Management
Container Created | Deleted Container | Container Modified | Container Permission Changes
Password Settings Changes

DNS

DNS Node Added | DNS Node Deleted | DNS Node Modified | DNS Zone Added | DNS Zone Deleted | DNS Zone Modified | DNS Permission Changes

GPO

GPO Created | GPO Deleted | GPO Modified | GPO Link Changes

Others

Schema Changes | Schema Permission Changes | Configuration Changes | Configuration Permission Changes | Site Changes

Local Logon Logoff

Local Logon Success | Local Logon Failures | Logoff | Other Local Logon

Local Logon Success
Interactive Logon success | Network Logon success | Unlock the System | Remote Interactive Logon Success | CachedInteractive Logon Success
Local Logon Failures
Interactive Logon Failure | Network Logon Failure | Logon Failure when Unlock the machine | Remote Interactive Logon Failure | CachedInteractive Logon Failure
Logoff
Other Local Logon
Session disconnected from winstation | Session reconnected to winstation | The workstation was locked | The workstation was unlocked | The screen saver was invoked | The screen saver was dismissed


Steps to select the above sub modules and the reports therein

  • Select a "Category" from the following options: Logon Activity | File Activity | AD Objects | DNS | GPO | Others | Local Logon Logoff
  • Every category will have a set of sub-modules and thereupon clicking ´>´ a set of reports will appear.
  • Then, users can choose the change events to be audited in the particular domain.

Columns to be Displayed

After choosing the audit report category & the reports to track the desired ´change events´, it is time to select the columns that display the crucial audit data. By default ´Selected Columns´ section will display the recommended colums; user can de-select & add columns of preference.

Category

Available Columns

Logon Activity

User Name | Client IP Address | Client Host Name | Where | Logon Time | Event Type | Failure Reason | Domain | Remarks | Logon Service | SID | Event Number | Event Code | Failure Code | Record Number

File Activity

Where | File Folder Name | Location | UNC Name | Time Accessed | User Name | Process Name | Remarks | Absolute Name | Accesses | Access Mask | Client Domain | Client Login ID | Client User Name | Domain | Event Number | Event Type | Handle ID

AD Objects

Account Name | Account Domain | Account SID | Caller user name | Caller user domain | Caller Logon Id | When | Event Number | Message | Where | Remarks | Record Number | Caller User SID | Event Code | Object Name | Modified Attributes | Target Object Class | New value

DNS

Object Name | Modified Time | Where | Remarks | Message | Modified Attributes | Target Object Class | Event Number | Event Type Code | Caller User SID | Record Number | New value | Old Value | Permission Changes | Domain | Account Name | Caller Logon Id | Caller user domain

GPO

Object Name | Modified Time | Where | Remarks | Message | Modified Attributes | Target Object Class | Event Number | Event Type Code | Caller User SID | Record Number | Old Value | New value | Client Domain | Permission Changes | New GPO Name | Parent Object | New GPO Distinguished Name


Filters

Set time duration based "Equals & Not Equals" event filters based on the above columns.

Available Filters: Equals | Not equals | Starts with | Ends with | Not starts with | Not ends with | Is like | Is not like | Contains | Not contains | Less than | Greater than |

You can also group filters based on a "And", "Or" pattern.

Charts

ADAudit Plus displays the graphical part of the audit data as graphs and the user can chose the chart type for the custom reports, which they thinkwill suit their audit report format.

Available Chart Types: Pie 3D | Pie Chart | Vertical Bar 3D | Horizontal Bar 3D | Time Series | Line | Stacked Vertical Bar 3D

Scheduler

The custom report can be sent to the email-id(s) entered in the text box "specify email address" on providing a check against "Email this scheduled report".

Category

Reports

Hourly

If you want to schedule this report to run every hour, enter the time after which this report has to run every one hour.

Daily

If you want to schedule this report to run everyday, enter the time at which this report has to run every day. With the data being fetched 24 hours from time of schedule (or) The previous day (0:00 hours to 23:59 hours).

Weekly

If you want to schedule this report to run every week, enter the day and time at which this report has to run every week. With the data being fetched 7 days from day of schedule (or) The previous week (Sunday to Saturday).

Monthly

If you want to schedule this report to run every month, enter the day and time at which this report has to run every month. With the data being fetched 30 days from day of schedule (or) The previous month (Day 1 to Day 30).

Business Hour

This option enables the administrator to set the business hours for reports to filter the results based on: All Hours| Business Hours | Non Business Hours


Provided below are the steps to schedule an hourly report

The "Schedule" will be scheduled to run once every hour.

  • Select the "Hourly" Radio option under "Schedule Report Frequency"

  • Enter the Starting time for the Schedule. This schedule will be run on a Hourly basis from the start time selected.

  • Previous Hour - When a user selects the "Previous Hour" option from the drop down. The data will be fetched once everytime the clock ticks a valid hour. Eg. (9:00 o' clock, 10:00 o' clock etc.,)
  • Last 60 minutes - This depends on the start time selected. The data will be fetched exactly 1 hour (60 minutes) from the time selected as start time.

Email Notification requires

Message Settings

The "Message Settings" need to be configured to define the text message and the format (link or attachment) in which the scheduled report will be delivered to users email ids.

To configure the "Message Settings"

  • Click on the "Message Settings" link under Email Notification

  • Select the options of your choice from the pop-up menu that is displayed.

  • Enter the Mail content Entering the " Subject" and "Message" in their respective boxes provided.

  • Click on OK.

Options selected to email or publish a scheduled report

Email Reports as an attachment

Reports are emailed as an attachment. The format of choice is selected under "Schedule Report Format" and could be any of the slected formats pdf, csv, html or xls.

Email Reports as a Zip File

The selected reports are compressed to a zip format and emailed.

Publish the report and email the link alone

Selecting this option the reports are published and the published link alone is emailed to users.

Email Empty Reports

Selecting this option will ensure, irrespective of the event occurrence, an empty report email will be sent.


Emailing a Scheduled Report

To notify a scheduled report by email:

  • Provide a check against "Email this scheduled report" under Email Notification section.
  • Specify email address in the Text box that is displayed.
  • Click on save.

This will email the scheduled report in the desired format (selected under "Message Settings") to all the entered email addresses.

Privacy

The custom report privacy can be set to "Everyone (Public)" & "Just me (Private)". The user can chose the folder where the reports can be saved. By default, the custom reports will be saved under "My Reports"

The Scheduled Reports can be stored in 'pdf', 'xls', 'html', or 'csv' formats by selecting the format of choice from the drop down. They are stored in the "File Storage Path" entered by clicking on the "File Storage Path" link.

  1. The default "File Storage Path" is ' <Installation Folder>\webapps\adap\schedule-reports\ '. The user can enter any desired storage path for the scheduled reports.
  2. The "File Server Path" is ' \\fileserver\auditing\scheduled-reports\ '
  3. On a different drive it is 'D:\Auditing\Reports\ '

How To View a Custom Report

  • Click on the "Reports" Tab > "Custom Reports" on the right side.
  • Select the Domain from the drop down box, to view the respective custom reports.
  • Click on the "View Reports" link on the right.

Also, the custom reports can be viewed from Reports > My Reports.

How To Edit a Custom Report

  • Click on the "Reports" Tab > "Custom Reports" on the right side.
  • Select the Domain from the drop down box, to view the respective custom reports.
  • Click on the "Customize" link on the right.
  • Modify the required settings and click on Update.

How To Delete a Custom Report

  • Click on the "Reports" Tab > "Custom Reports" on the right side.
  • Select the Domain from the drop down box, to view the respective custom reports.
  • Click on the "Delete" link on the right.

Also, the custom reports can be deleted from Reports > My Reports. Click on the icon.

Copyright © 2020, ZOHO Corp. All Rights Reserved.
ManageEngine
Get download link