Change History Details
Rule description
This rule queries the Change History database and displays Change History details for any Active Directory or Microsoft 365 operation that is stored in the database and satisfies the specified search criteria.
When to use this rule
Use this rule when you need to get the report with change history details for some Active Directory or Office 365 operation. You can specify a definite period of time when the changes were made, operation initiator, action name and etc. For details on how to create a new rule please see this article: Create new rule.
Rule settings
Query section
| Setting | Description |
|---|---|
Report format |
Specify the report format:
|
| When From (date) To (date) | |
| Specify the period of time for which you want to get the report. You can set dates or select one of the values in the When setting: Last 24 hours, this week, this month, etc. | |
| Who | When Web Portal is configured to use the Active Directory authentication method, provide Domain\LogonName. When configured to use the Azure AD authentication method, provide the user principal name. Separate multiple accounts by ";". |
| What (Actions) | Specify Web Action name. You can separate multiple names by ";". |
| Object location or path | For objects in AD, provide a domain or Organizational Unit path (canonical name). Separate multiple paths by ";". For objects in Microsoft 365, provide a display name. Leave empty to return all objects. |
| Object name contains | Specify the string that the object name should contain. Separate multiple strings by ";". |
Additional Filter | |
|
Specify the string that the property name and its values should contain. Separate multiple strings by ";". |
| Client IP | Specify client IP address string. Example: "10.30.0.1". |
| Initiator comment | Specify the string that the initiator comment should contain. Separate multiple strings by ";". |
| Ticket # | Specify the string that the initiator comment should contain. Separate multiple strings by ";". |
| Operation data (advanced) | Specify the string anywhere within operation data. Separate multiple strings by ";". |
Other Query Settings | |
Properties to display |
Each object property defined in this setting matches the column that will be displayed in the Web Portal for this web query. To display additional columns, add the required properties to the Properties to display list. |
Filter |
Set the filtering conditions to hide unwanted data based on criteria not supported in the Query criteria setting. Example: filter by the found object Distinguished Name. TIP: For optimal performance, use the Query criteria setting above to filter objects whenever possible. |
Sort by |
Sort result object list. |
Order |
Specify sorting order: ascending or descending. |
Maximum returned results |
The maximum number of records. By default, all records are displayed. |
Initialization script |
Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to the PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. IMPORTANT: To use a variable, declared in the initialization script, in the query scope, it must be global: Example: Update AD users, created in the last ten days.
|
Output section
This section defines the output format of this rule.
To get more information about this section, please see the Rule Output section article.
Enforce/Schedule section
This section defines the schedule for how often to run the rule.
To get more information about this section, please see the Rule Enforce/Schedule section article.
Version history
| Version | Changes |
|---|---|
| 12.5.0 | The Object location or path, Property name contains, and What (Actions) settings have been updated to feature dedicated pickers. |
Comments
0 comments
Please sign in to leave a comment.