Articles in this section

See more
Print

Change History Details rule

  • Updated
Follow

Rule Description

This rule queries the Change History database and displays Change History details for any Active Directory or Office 365 operation that is stored in the database and satisfies the specified search criteria. 

 

When to use this rule

Use this rule when you need to get the report with change history details for some Active Directory or Office 365 operation. You can specify a definite period of time when the changes were made, operation initiator, action name and etc. For details on how to create a new rule please see this article: https://support.cayosoft.com/hc/en-us/articles/360015253192#Createnewrule 

 

Rule Settings

Query Section

Setting name Description
When

From (date)

To (date)

 Specify the period of time for which you want to get the report. You can set dates or select one of the values in the When setting: Last 24 hours, this week, this month, etc.
Who When Web Portal is configured to use the Active Directory authentication method, provide Domain\Logon Name.

When configured to use the Azure AD authentication method, provide the user principal name. Separate multiple accounts by ";".
What (Actions) Specify Web Action name. You can separate multiple names by ";".
Object location or path For objects in AD, provide Domain or Organizational Unit path (canonical name). Separate multiple paths by ";". For objects in Office 365, provide a display name.
Object name contains Specify the string that the object name should contain. Separate multiple strings by ";".

Additional Filter

  
Property name contains

Old value contains

New value contains

 Specify the string that the property name and its values should contain. Separate multiple strings by ";".
Client IP Specify client IP address string. Example: "10.30.0.1".
Initiator comment Specify the string that the initiator comment should contain. Separate multiple strings by ";".
Ticket Specify the string that the initiator comment should contain. Separate multiple strings by ";".
Operation data (advanced) Specify the string anywhere within operation data. Separate multiple strings by ";".

Other Query Settings

  

Properties to display

To display additional properties for each object found by the query, add those properties to the list.

Filter

To hide unwanted data set the filtering conditions here.

Sort by

Sort result object list.

Order

Specify sorting order: ascending or descending.

Maximum returned results

The maximum number of records. By default, all records are displayed. 

Report format

Specify the report format:

  1. One report row per property, with old and new values.
  2. One report row per operation, no property values.

Initialization script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.

Example: Get all objects, created in the last ten days.

  1. Add this initialization script:
{$global:DatePeriod = (Get-Date).AddDays(-10)}
  1. Use $DatePeriod variable in query criteria builder:

 

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

 

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

 

Change History

Version Notes
6.3.1 The rule is introduced in the product.

 

 

Related articles

Comments

0 comments

Please sign in to leave a comment.