Windows-specific Advanced Audit Policy Configuration.
Fields
| Field Name | Description |
|---|---|
system - AuditSystem!
|
System category: Audits changes to the system-level settings and security state. |
logonLogoff - AuditLogonLogoff!
|
Logon/Logoff category: Audits user logon, logoff, and related authentication events. |
objectAccess - AuditObjectAccess!
|
Object Access category: Audits access attempts to files, registry keys, and other securable objects. |
privilegeUse - AuditPrivilegeUse!
|
Privilege Use category: Audits the use of user rights and privileges. |
detailedTracking - AuditDetailedTracking!
|
Detailed Tracking category: Audits detailed process and application activity. |
policyChange - AuditPolicyChange!
|
Policy Change category: Audits changes to security policies and audit policies. |
accountManagement - AuditAccountManagement!
|
Account Management category: Audits account creation, deletion, and management operations. |
dsAccess - AuditDSAccess!
|
DS Access category: Audits Active Directory Domain Services access and changes. |
accountLogon - AuditAccountLogon!
|
Account Logon category: Audits credential validation events. |
Used by
AuditPolicytype: The security event auditing configuration of an Endpoint.AuditPolicyOsSpecificunion: OS-specific audit policy union type.
Example
Example
{
"system": AuditSystem,
"logonLogoff": AuditLogonLogoff,
"objectAccess": AuditObjectAccess,
"privilegeUse": AuditPrivilegeUse,
"detailedTracking": AuditDetailedTracking,
"policyChange": AuditPolicyChange,
"accountManagement": AuditAccountManagement,
"dsAccess": AuditDSAccess,
"accountLogon": AuditAccountLogon
}