You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
1.2 KiB
51 lines
1.2 KiB
<form version="1.1">
|
|
<label>Administrator Audit - Microsoft Exchange</label>
|
|
|
|
<fieldset autoRun="true">
|
|
<input token="host" type="text">
|
|
<label>Host</label>
|
|
<default>*</default>
|
|
<prefix>host="</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input token="user" type="text">
|
|
<label>Administrator</label>
|
|
<default>*</default>
|
|
<prefix>User="</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input token="cmdlet" type="text">
|
|
<label>Command</label>
|
|
<default>*</default>
|
|
<prefix>Cmdlet="</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input token="param" type="text">
|
|
<label>Parameter</label>
|
|
<default>*</default>
|
|
<prefix>Param="</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input type="time" />
|
|
</fieldset>
|
|
|
|
<row>
|
|
<table>
|
|
<search>
|
|
<query>
|
|
eventtype=msexchange-admin-audit $host$ $user$ $cmdlet$ $param$
|
|
|dedup Identity
|
|
|eval dt=strftime(_time,"%c")
|
|
|eval Error=split(Error,"\\n")
|
|
|eval Timestamp=dt
|
|
|eval Server=host
|
|
|eval Parameters=CmdletParam
|
|
|table Timestamp,Server,User,Cmdlet,Parameters,Success,Error
|
|
</query>
|
|
</search>
|
|
<option name="count">25</option>
|
|
<option name="rowNumbers">true</option>
|
|
<option name="showPager">true</option>
|
|
</table>
|
|
</row>
|
|
</form> |