SEC Auditing

Hello Dennis Haschke,

I haven't done it but according to the Auditing Guide this should be possible.

Christian

Thanks, actually i'm reading the guide :-)
Seems not so easy :-(

Hello Dennis Haschke,

where's the problem? What specifically is it that Seems not so easy?

Christian

I try the report like in the guide beginning on site 14, chapter 7.2 due to 7.4. This works fine. But i don't know what i must do to search for all group changes till last 3 month. The query i don't know.

Hello Dennis Haschke,

guess by group changes you mean a computer that was moved to some other group?
For a start, similar to Example 3 in chapter 8.2. (page 16),, keep just the Timestamp>=...  and  (TargetType='Computer') AND (Action='Assign') parts.

Christian

OK, I try this query:

SELECT *
FROM SophosSecurity.Reports.vAuditEventsAll
WHERE (Timestamp>=DATEADD(mm,-3,GETUTCDATE()))
AND ((TargetType='Computer')) AND
(Action='Assign')

Seems to work :-)
Thanks a lot.

I think that a person who is satisfied with his income can be found only among very wealthy people. Others, in any case, will always talk about the fact that they lack something. In any case, you can always sit down at the computer and make money. Here https://2captcha.com/ as an option offer work with captcha (recognition) from you need only a few hours a day, but earnings are not limited can even if the day sit.