Document toolboxDocument toolbox

Activeboard: Windows System Audit

Purpose

The Windows System Audit Activeboard performs detailed system-level analysis on the Windows host by analyzing system events, account login statuses, and policy changes.

Filter by Host: Select input

Events Over Time: Line chart widget

More Recent Audit Events: Table widget

Total Audit Success: Simple value widget

Account logons: Column chart widget

Processes created: Table widget

Total Audit Failures: Simple value widget

Accounts with 10 or more failed loggons per hour: Pie chart widget

Audit Policy changes: Table widget

 

Prerequisites

To run this Activeboard, you must have the following data sources available on your domain:

Open Activeboard

Once you have installed the Activeboard, you can use the Open button at the top right of the card in Exchange to access it and see the different widgets populated with the relevant data. You can also access the Activeboard area via the Navigation pane.

Data loading takes too long?

Sometimes some widgets take time to upload the data, it is possible to speed up the process by creating aggregation tasks. Refer to the Aggregation tasks article to learn how to do it.

Use Activeboard

After installing and opening the Activeboard, you can use its widgets to visualize and monitor data. To do this, each widget offers a variety of customization and visualization options. Refer to Using widgets and Using inputs to know them all.