Policy Change audit subcategories for monitoring security policy modifications.
Fields
| Field Name | Description |
|---|---|
auditPolicyChange - AuditPolicySetting!
|
Audits changes to the audit policy configuration. |
authenticationPolicyChange - AuditPolicySetting!
|
Audits changes to authentication policies such as Kerberos settings. |
authorizationPolicyChange - AuditPolicySetting!
|
Audits changes to authorization policies and permissions. |
mpssvcRuleLevelPolicyChange - AuditPolicySetting!
|
Audits changes to Windows Firewall rules and policies. |
filteringPlatformPolicyChange - AuditPolicySetting!
|
Audits changes to Windows Filtering Platform policies. |
otherPolicyChangeEvents - AuditPolicySetting!
|
Audits other policy change events not covered by specific subcategories. |
Used by
AuditPolicyWindowstype: Windows-specific Advanced Audit Policy Configuration.
Example
Example
{
"auditPolicyChange": "SUCCESS",
"authenticationPolicyChange": "SUCCESS",
"authorizationPolicyChange": "SUCCESS",
"mpssvcRuleLevelPolicyChange": "SUCCESS",
"filteringPlatformPolicyChange": "SUCCESS",
"otherPolicyChangeEvents": "SUCCESS"
}