HOW TO CONFIGURE REAL-TIME ALERTS FOR NETWRIX NON-OWNER MAILBOX ACCESS REPORTER FOR EXCHANGE

Transcription

1 HOW TO CONFIGURE REAL-TIME ALERTS FOR NETWRIX NON-OWNER MAILBOX ACCESS REPORTER FOR EXCHANGE Product Version: 3.0 July/2012.

2 Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from NetWrix Corporation of any features or functions discussed. NetWrix Corporation assumes no responsibility or liability for the accuracy of the information presented, which is subject to change without notice. NetWrix is a registered trademark of NetWrix Corporation. The NetWrix logo and all other NetWrix product or service names and slogans are registered trademarks or trademarks of NetWrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners. Disclaimers This document may contain information regarding the use and installation of non-netwrix products. Please note that this information is provided as a courtesy to assist you. While NetWrix tries to ensure that this information accurately reflects the information provided by the supplier, please refer to the materials provided with any non-netwrix product and contact the supplier for confirmation. NetWrix Corporation assumes no responsibility or liability for incorrect or incomplete information provided about non-netwrix products NetWrix Corporation. All rights reserved. Page 2 of 19

3 Table of Contents 1. INTRODUCTION Overview How this Document is Organized REAL-TIME ALERTS OVERVIEW INSTALLING AND CONFIGURING NETWRIX NON-OWNER MAILBOX ACCESS REPORTER FOR EXCHANGE INSTALLING AND CONFIGURING NETWRIX EVENT LOG MANAGER CONFIGURING REAL-TIME ALERTS Event Description Filtering Alerts by Insertion Strings A APPENDIX: SUPPORTING DATA A.1 Related Documentation Page 3 of 19

4 1. INTRODUCTION 1.1. Overview NetWrix Non-owner Mailbox Access Reporter For Exchange Technical Article This technical article is intended to assist you in configuring real-time alerts for NetWrix Non-owner Mailbox Access Reporter for Exchange using NetWrix Event Log Manager. This document provides brief information on how to install the two products, and also contains step-by-step instructions that will guide you through configuration of the real-time alerts. The article is intended for system administrators and integrators How this Document is Organized This part explains how this document is organized and provides a brief overview of each section. Section 1 Introduction - the current section. It explains the purpose of this document and outlines its structure. Section 2 Real-time Alerts Overview provides a brief review of alerts and explains how NetWrix Non-owner Mailbox Access Reporter for Exchange and NetWrix Event Log Manager operate together to provide real-time alerts on non-owner mailbox access. Section 3 Installing and Configuring NetWrix Non-owner Mailbox Access Reporter for Exchange provides a general explanation on the installation of NetWrix Non-owner Mailbox Access Reporter for Exchange. Section 4 Installing and Configuring NetWrix Event Log Manager provides a general explanation on installing NetWrix Event Log Manager and configuring it to alert users on NetWrix Non-owner Mailbox Access Reporter for Exchange events. Section 5 Configuring Real-time Alerts explains how to configure real-time alerts triggered by Non-owner Mailbox Access Reporter for Exchange events. Appendix: Supporting Data contains a list of documents you can refer to for more details on the two products. Page 4 of 19

5 2. REAL-TIME ALERTS OVERVIEW NetWrix Non-owner Mailbox Access Reporter for Exchange and NetWrix Event Log Manager can be configured to provide real-time alerts triggered by non-owner mailbox access events (e.g. opening a message folder, opening/modifying/deleting a message, etc.). NetWrix Non-owner Mailbox Access Reporter for Exchange monitors Exchange servers: the product agent collects data on all non-owner mailbox access events and records it in the event log. NetWrix Event Log Manager configured to monitor the event log of NetWrix Non-owner Mailbox Access Reporter for Exchange collects the logs, checks them for the events that trigger alerts, and sends notifications to the specified recipients if such events are detected. To enable real-time alerts for NetWrix Non-owner Mailbox Access Reporter for Exchange, you need to install NetWrix Event Log Manager and configure the two products to work together. Page 5 of 19

6 3. INSTALLING AND CONFIGURING NETWRIX NON-OWNER MAILBOX ACCESS REPORTER FOR EXCHANGE To install NetWrix Non-owner Mailbox Access Reporter for Exchange, follow the procedure below: Procedure 1. To install and configure NetWrix Non-owner Mailbox Access Reporter for Exchange 1. Download NetWrix Non-owner Mailbox Access Reporter for Exchange. Run the setup package called nombafull_setup.msi. Follow the instructions of the installation wizard. For detailed information on the installation, refer to NetWrix Non-owner Mailbox Access Reporter for Exchange Installation Guide. 2. Verify the product configuration: navigate to Start All Programs NetWrix Non-owner Mailbox Access Reporter for Exchange Configure Non-owner Mailbox Access Reporter and make sure that the Enable box for Exchange Servers and the Use Agents to collect detailed audit data box are checked. 3. In Reports, specify the required settings. Use the Verify button to check your report delivery settings. 4. In Audit Archive, leave the default parameters or specify your own settings. Figure 1: Configure NetWrix Non-owner Mailbox Access Reporter for Exchange 5. Click Apply. Page 6 of 19

7 6. In the Scheduled Task Credentials window, specify the account for data collection from your Exchange servers. Make sure the account has administrative rights on the servers. Figure 2: Scheduled Task Credentials 7. Click OK. Refer to the NEXT STEPS: CHECKLIST pop-up prompting you to perform several steps to verify that the product is working correctly. Follow the instructions. Figure 3: NEXT STEPS: CHECKLIST 8. Check the Do not show this message again box if you do not want this dialog to be displayed next time you change the product configuration. Click Done. Page 7 of 19

8 4. INSTALLING AND CONFIGURING NETWRIX EVENT LOG MANAGER To install NetWrix Event Log Manager, follow the procedure below: Procedure 2. To install and configure NetWrix Event Log Manager 1. Download NetWrix Event Log Manager. Run the setup package called elmfull_setup.msi. Follow the instructions of the installation wizard. For detailed information on the product installation, refer to NetWrix Event Log Manager Installation and Configuration Guide. 2. Start NetWrix Enterprise Management Console: navigate to Start All Programs NetWrix Enterprise Management Console. 3. Now you need to create a Managed Object which is a computer collection that you monitor for events. In NetWrix Enterprise Management Console, click the Managed Objects node in the left pane. The Managed Objects page will be displayed. 4. Click Create New Managed Object in the right pane, or, alternatively, rightclick the Managed Objects node and select New Managed Object from the popup menu to start the New Managed Object wizard. 5. On the first step, select Computer Collection as the Managed Object type and click Next. 6. Name the computer collection and verify the Data Processing Account information. Click Next. 7. In the Add Modules window, verify that the Event Log Manager checkbox is selected in the Installed Modules. Click Next. 8. You do not need to enable reports: in the Report Settings window, uncheck Enable Reports. Click Next. 9. In Add Items to Collection, click Add, and select the Windows Server item type. 10. In Specify Items, enter your Exchange Server information. Click Next. 11. In Review New Item Settings, check the information and click Finish. Your Exchange server has been added to the collection. In the Add Items to Collection, click Next. 12. Check the Enable Network Traffic Compression option in the next window. Click Next. 13. In Specify Events Summary Recipients, you do not need to enter the address of the user to receive the summary as Non-owner Mailbox Access Reporter for Exchange will send daily s. Click Next. 14. In the Configure Real-time Alerts window, leave the predefined alert boxes blank and click Next. Page 8 of 19

9 15. In the Configure Audit Archiving Filters window, in Inclusive Filters, click Add and specify the following information: The filter name and description (e.g. NOMBA). In the Event Log, enter NetWrix Non-owner Mailbox Access Agent: this value is the same value as the Event Log created within your Exchange Server. There will be no drop-down for this value, simply type it in or copy-paste it directly from the Exchange server. In Write to, select the Audit Archive radio button. The events will be saved into the local repository. Click OK. Figure 4: Inclusive Event Filters 16. Remove the filters you do not need from the Inclusive Filters section. Click Next. 17. In Review Your Managed Object Settings, check the information and click Finish. The message informing you on the successful configuration is displayed. Click OK. 18. Your new Managed Object has been created. To view it, in the left pane of NetWrix Enterprise Management Console, expand the Managed Objects node and select the Managed Object name. The information on the object appears in the right pane: the General tab displays the modules configured for the selected Managed Object. The Items tab allows you to view and edit the collection settings and items. 19. In NetWrix Enterprise Management Console, navigate to Managed Objects <your Managed Object name> Event Log Manager and verify that the Enable the Event Log Manager box is checked in the right pane. Page 9 of 19

10 5. CONFIGURING REAL-TIME ALERTS To configure the alerts, follow the procedure below: Procedure 3. To configure real-time alerts 1. In NetWrix Enterprise Management Console, navigate to Managed Objects <your Managed Object name> Event Log Manager Real-time Alerts. Right-click this node and select New Real-time Alert. Figure 5: New Real-time Alert 2. In the Specify Real-time Alert Properties, specify the Name and Description of the alert and the number of Alerts per one . Click Next. Figure 6: New Alert Properties Page 10 of 19

11 3. In Configure Real-time Alert Filters and Notifications, specify at least one event filter that will trigger the alert. To add a new filter, click Add in the Event Filters section. 4. In Event Filters, specify the filter name and description, and in the Event Log field type-in NetWrix Non-owner Mailbox Access Agent. Figure 7: Event Filters 5. You may also want to be more specific and only receive alerts on particular event types (e.g. folders opened or messages deleted). In this case, click the Event Fields tab at the top, check the Event ID box, and enter a value. In the Source field, enter NetWrix Non-owner Mailbox Access Agent. Click OK. Figure 8: Event Fields Page 11 of 19

12 NetWrix Event Log Manager can be configured to send alerts on the following event IDs from the NetWrix Non-owner Mailbox Access Agent event log: Table 1: Event IDs and Descriptions ID Description Access Type (as displayed in XML view of event details) 1 A folder was opened actfolderopen 2 A message was opened actmessageopened 3 A message was sent actmessagesubmit 4 A message was changed and saved actchangedmessagesaved 5 A message was deleted actmessagedeleted 6 A folder was deleted actfolderdeleted 7 The entire contents of a folder was actallfoldercontentsdeleted deleted 8 A message was created and saved actmessagecreatedandsaved 9 A message was moved or/and copied actmessagemovecopy 10 A folder was moved or/and copied actfoldermovecopy 14 A folder was created actfoldercreated If you want to create multiple alerts for different Event IDs, simply repeat the procedure to create more alerts. For more details on event details, refer to the Event Description section of this document. 6. In Configure Real-time Alert Filters and Notifications, the Notifications section, either leave the Events Summary recipients radio button selected or select the Specify recipients: radio button, click Add, specify an address and click Verify. Wait for the test message to arrive and click OK. Figure 9: Specify Real-time Alert Recipients Page 12 of 19

13 7. You can modify the alert notification template. Click Edit next to Customize notification template: The Edit Notification Template window is displayed: Figure 10: Edit Notification Template The template is in the HTML format. By default, NetWrix Event Log Manager alerts contain %String1%, %String2%, and %String3%. Modify your template as required and click OK. 8. In Configure Real-time Alert Filters and Notifications, click Next. Review the alert settings and click Finish. For more information on customizing real-time alerts, refer to the Event Description section below. Page 13 of 19

14 5.1. Event Description NetWrix Non-owner Mailbox Access Reporter For Exchange Technical Article This section provides you with event examples and explanation of their details. You can use it to customize your alerts. Below you can see an example of a MessageOpened event in the XML view. Figure 11: Event Details (XML view) for a MessageOpened Event The MessageOpened event description contains the following strings: Table 2: MessageOpened Event Description Strings String Description Example String1 Event type <Data>info</Data> String2 Event date and time <Data>2012_05_29_12_58_30_303</D ata> String3 Name of the user accessing <Data>ASDF\Administrator</Data> mailbox String4 SID of the user accessing mailbox <Data>S </Data> String5 GUID of the mailbox being accessed <Data>{9E4DCC3B-F1AA A404EE44544}</Data> String6 shows whether the user <Data>false</Data> accessing the mailbox is the owner: it is always false. String7 IP of the computer accessing the <Data> </Data> mailbox String8 Access type <Data>actMessageOpened</Data> String9 Internal Message URL <Data>/Inbox/testMessage.EML</Data> String10 Message Subject <Data>testMessage</Data> String11 Message type <Data>IPM.Note</Data> String12 Information for internal use <Data> </Data> String13 Information for internal use <Data> </Data> String14 Information for internal use <Data> </Data> String15 Information for internal use <Data>false/false/true</Data> String16 Mailbox being accessed <Data>testuser1@asdf.local</Data> With different Exchange Server versions and/or different clients (Outlook 2003, 2007, 2010, OWA), the same non-owner action (e.g. copying a message) may generate different events: e.g. actmessagemovecopy with one server/client or actmessagecreatedandsaved with another. Page 14 of 19

15 Depending on the event, the strings in the description vary. The first eight strings are common for all events: String String1 String2 String3 String4 String5 String6 String7 String8 Table 3: Common Event Description Strings Description The event type: info or warning The event date and time in the following format: YYYY_MM_DD_hh_mm_ss_000 The name of the user accessing mailbox The SID of the user accessing mailbox The GUID of the mailbox being accessed shows whether the user accessing mailbox is the owner: it is always false The IP of the computer accessing the mailbox The access type The following strings depend on the non-owner access type, represented by different Event IDs: Event ID Table 4: Description Strings Depending on the Event Access type (String 8) Strings Description 1 actfolderopen String9 The internal folder URL 2 actmessageopened String9 The internal message URL String10 The message subject String11 The message type: IPM.Note , IPM.Contact contact, etc. 3 actmessagesubmit String9 The internal message URL String10 The message subject String11 addresses of the message recipients, separated by a semicolon String12 The message type: IPM.Note , IPM.Contact contact, etc. 4 actchangedmessagesaved String9 The internal message URL String10 The message subject String11 The message type: IPM.Note , IPM.Contact contact, etc. 5 actmessagedeleted String9 The internal message URL String10 The message subject String11 The message type: IPM.Note , IPM.Contact contact, etc. 6 actfolderdeleted String9 The internal folder URL 7 actallfoldercontentsdelete d 8 actmessagecreatedandsave d String9 String9 The internal folder URL The internal message URL 9 actmessagemovecopy String9 The message being moved/copied the final part of the message URL, e.g. /Inbox/testMessage.EML String10 The action copy or move String11 The folder URL the message is copied/moved from String12 The destination folder URL String13 The message type: IPM.Note , IPM.Contact contact, etc. 10 actfoldermovecopy Strings 9-13 The string descriptions for the folder are the similar to those for messages. 14 actfoldercreated String9 The new folder URL Page 15 of 19

16 You can add the required strings contained in % symbols for your own custom alert separated by a <br> tag in <b>event Parameters:</b>. Event parameter descriptions can also be added. In the example below, the following information has been added: The description for String 3 User Accessing mailbox; String 8 with the description; String 9 with the description. Figure 12: Customized Notification Template The alert based on this template looks as follows: Figure 13: Customized Alert Page 16 of 19

17 5.2. Filtering Alerts by Insertion Strings You can filter real-time alerts using Insertion Strings. To create a filter, perform the following steps: 1. Select the alert, click Edit. The Event Filters window appears. 2. Click the Insertion Strings tab and check the Consider the following event Insertion Strings: box. 3. Click Add and specify the field that you want to filter by. Wildcards are supported. In this example we use Index 16 for the mailbox being accessed. 4. Click OK. Your events will be filtered by the string specified. Figure 14: Event filters Page 17 of 19

18 A NetWrix Non-owner Mailbox Access Reporter For Exchange Technical Article APPENDIX: SUPPORTING DATA A.1 Related Documentation The table below lists the documents supporting configuration of real-time alerts for NetWrix Non-owner Mailbox Access Reporter for Exchange using NetWrix Event Log Manager. Table 5: Supporting Documentation Document Name NetWrix Non-owner Mailbox Access Reporter Installation Guide NetWrix Non-owner Mailbox Access Reporter for Exchange Administrator s Guide NetWrix Non-owner Mailbox Access Reporter for Exchange Quick Start Guide NetWrix Non-owner Mailbox Access Reporter for Exchange Freeware Edition Quick Start Guide NetWrix Non-owner Mailbox Access Reporter for Exchange Release Notes NetWrix Event Log Manager Installation and Configuration Guide NetWrix Event Log Manager Administrator s Guide NetWrix Event Log Manager Quick-Start Guide (Enterprise Edition) NetWrix Event Log Manager Quick-Start Guide (Freeware Edition) NetWrix Event Log Manager User Guide Overview This guide is intended for administrators who configure and work with NetWrix Non Owner Mailbox Access Reporter in production environments. The guide is a complete reference for the configuration and use of the product. Provides information on the NetWrix Nonowner Mailbox Access Reporter for Exchange functionality, and instructions on how to configure and use the product. This guide is intended for product evaluation purposes. It provides an overview of the product functionality, and instructions on how to install, configure and start using NetWrix Non-owner Mailbox Access Reporter for Exchange. This guide only covers the product s basic functionality and configuration options. This guide is intended for evaluation purposes of the product s Freeware Edition. It provides an overview of the product functionality, and instructions on how to install, configure and start using NetWrix Non-owner Mailbox Access Reporter for Exchange Freeware Edition. Provides a list of currently know issues that users may encounter in the current product version and suggests a workaround for these issues. Provides detailed instructions on how to install and configure NetWrix Event Log Manager. Provides detailed instructions on how to configure and use NetWrix Event Log Manager. Provides an overview of the product s functionality, and instructions on how to install, configure and start using NetWrix Event Log Manager (Enterprise Edition). Provides an overview of the product s functionality, and instructions on how to install, configure and start using NetWrix Event Log Manager (Freeware Edition). Provides information on different NetWrix Page 18 of 19

19 NetWrix Event Log Manager Release Notes Event Log Manager reporting capabilities and lists all available report types and report formats, and explains how these reports can be viewed and interpreted. The document provides a list of known issues that customers may experience while using the release version 4.0. Page 19 of 19