Go Up
You are here: AdministrationMonitored Object Types, Actions, and Attributes

Monitored Object Types, Actions, and Attributes

Review the list of object types, attributes and components audited and reported by Netwrix Auditor.

Review the list of actions audited and reported by Netwrix Auditor. Actions vary depending on the data source and the object type.

Action Data source
 

Added + + +* + + + + + +
Removed + + +* + + + + + +

Modified

+ + +* + + + + + +
Add (failed attempt) + +

Remove (failed attempt)

+ +

Modify (failed attempt)

+ + +
Read +* + + +
Read (failed attempt) + +
Renamed + +** +
Moved +* + +

Rename (failed attempt)

+ +

Move (failed attempt)

+
Checked in +
Checked out +

Discard check out

+

Successful logon

+ + + +
Failed logon + + + +
Logoff +
Copied +* + +**
Sent +*
Activated +
State-in-time data collection
 

Support for state-in-time data collection + - - +

+

(for SharePoint only)

- - - + - -

NOTE: Actions marked with asterisk (*) are reported when auditing non-owner mailbox access for Exchange or Exchange Online.

Actions marked with asterisk (**) are reported for SharePoint Online only.

For Windows file servers, NetApp appliances, and EMC storages, audited actions vary depending on the file server type and object (file, folder, or share). For detailed information, refer to the table below.

Action Windows-based NetApp EMC
  file folder share file folder share file folder share
Added + + + + + + + + +
Add (failed attempt) + + +* +*
Modified + + + + + + + + +
Modify (failed attempt) + + + + + + +
Moved + + +** +** +* +*
Move (failed attempt) +** +** +* +*
Read + + - +
Read (failed attempt) + + + + + + +
Renamed + + +** +** +* +*
Renamed (failed attempt) +** +** +* +*
Removed + + + + + + + + +
Remove (failed attempt) + + + + + +
Copied +
State-in-time data collection
Support for state-in-time data collection + + + + + + + + +

NOTE: Actions marked with asterisk (*) are reported for EMC Isilon only.
Consider that for other EMC storage systems change reporting may not produce the results you expect – due to native EMC audit peculiarities.

Actions marked with asterisks (**) are reported for NetApp Clustered Data ONTAP 8 and ONTAP 9 only.

Go Up