Go Up
You are here: AdministrationMonitored Object Types, Actions, and Attributes

Monitored Object Types, Actions, and Attributes

Review the list of object types, attributes and components audited and reported by Netwrix Auditor.

Review the list of actions audited and reported by Netwrix Auditor. Actions vary depending on the data source and the object type.

Action Data source
 

Added + + +* + + + + + +
Removed + + +* + + + + + +

Modified

+ + +* + + + + + +
Add (failed attempt) + +

Remove (failed attempt)

+ +

Modify (failed attempt)

+ + +
Read +* + + +
Read (failed attempt) + +
Renamed + +** +
Moved +* + +

Rename (failed attempt)

+ +

Move (failed attempt)

+
Checked in +
Checked out +

Discard check out

+

Successful logon

+ + + +
Failed logon + + + +
Logoff +
Copied +* + +**
Copy (failed attempt) +
Sent +*
Activated +

NOTE: Actions marked with asterisk (*) are reported when auditing non-owner mailbox access for Exchange or Exchange Online.

For Windows file servers, NetApp appliances, and EMC storages, audited actions vary depending on the file server type and object (file, folder, or share). For detailed information, refer to the table below.

Actions marked with asterisk (**) are reported for SharePoint Online only.

Action Windows-based NetApp EMC
  file folder share file folder share file folder share
Added + + + + + + + + +
Add (failed attempt) + + +* +*
Modified + + + + + + + + +
Modify (failed attempt) + + + + + + +
Moved + + + + + +
Move (failed attempt) +** +** +* +*
Read + +*** + - +
Read (failed attempt) + + + + + + +
Renamed + + +** +** +* +*
Renamed (failed attempt) +** +** +* +*
Removed + + + + + + + + +
Remove (failed attempt) + + + + + +
Copied + + + + + + +
Copy (failed attempt) + + + + + +

NOTE: Actions marked with asterisk (*) are reported for EMC Isilon only.

Actions marked with asterisks (**) are reported for NetApp Clustered Data ONTAP 8 and ONTAP 9 only.

By default, actions marked with asterisks (***) are reported for Windows-based file servers as a summary—each entry represents several identical reads occurring from the same workstation within 10 minutes.

Go Up