XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 7. Safeguard Selection Criteria
XYPRO Technology Corporation 137 Proprietary and Confidential
What you Type: What Safeguard puts in its Audit Trail:
Add
Alter
Delete
Logon
CREATE
CHANGE
PURGE
VERIFYUSER
Safeguard OPERATIONS Notes:
VERIFYUSER This is the OPERATION that Safeguard writes in the audit record
when it authenticates a user.
AUTHENTICATE This is the OPERATION that Safeguard writes to the audit record
when a product other than Safeguard authenticates a user.
Netbatch, XAC, and XUA events all generate AUTHENTICATE
records.
LOGON The HP documentation states that this OPERATION is reserved for
future use.
UPDATE When the contents of a file are altered, Safeguard records the
OPERATION as UPDATE.
If you want to generate an alert whenever anyone alters a very
sensitive file (for example, where customer PINs are stored), select
the UPDATE operation.
Note: If you alter an existing keyword value to the same value (for example, if you
“alter safeguard, PASSWORD-HISTORY 10” and the value was already 10),
you will see only the Primary Record and no before and after records. This is
because Safeguard writes the Primary Record before it discovers that no
change was actually made.
7.3 Safeguard Message Codes
Safeguard stores the actual OUTCOME as a number (called a Message Code) in its
audit trail. You may find it helpful to select audit records based on the Message Code
itself when the code is what makes the records you wish to monitor unique.
For example, if you want to monitor only logons that were denied because the user’s
password was expired, you could select records where
AUDIT.MESSAGECODE = 401.
If you wanted to monitor only logons that were denied because the userid was frozen,
you could select records where AUDIT.MESSAGECODE = 404.