Searching for Specific Events

If you are looking for specific events, e.g., changes to user groups, activity on a certain server performed by a single user, it does not make sense to review all change records. You can jump right to inspecting changes you are interested in. With flexible search parameters, you can construct a search query that fits your auditing needs.

The search conditions describe what you are looking for. Each entry consists of three fields: the filter, the match type, and the value. You can add as many search entries to your search as you want, Cygna Auditor will look for records that match all search conditions at once.

FIELD	DESCRIPTION
Filter	The filter corresponds to the type of information you are searching for. For example, user, server, or when. Some filters are specific to the source, e.g., mailbox folder is for Exchange Online only and region display name is for AWS only. Such filters are grouped under the data source name. To filter events by outcome—whether the change action succeeded or failed—use the Action result filter.
Match type (comparison operator)	The match type defines if you are looking for an exact entry (is) or for any entry containing the searched value (contains). You can also search for an entry that starts with or ends with a certain value. The exact and broad search can be negative as well (is not and does not contain). When you are searching for sources, you can use the following match types: is any of and is not any of. They enable you to specify multiple sources from the list and to search for changes in any of those sources, or in all sources except the selected ones, respectively. When filtering events by time (the When filter), you can choose from the following match types: is today, is after, is before , is between for time range, and is in the last X days.
Value	The value field is the area where you specify a value to be searched. For example, the name of a user or a date range. Depending on the filter, you can select a value from the drop-down list or enter it manually.

FIELD

DESCRIPTION

Filter

The filter corresponds to the type of information you are searching for. For example, user, server, or when.

Some filters are specific to the source, e.g., mailbox folder is for Exchange Online only and region display name is for AWS only. Such filters are grouped under the data source name.

To filter events by outcome—whether the change action succeeded or failed—use the Action result filter.

Match type (comparison operator)

The match type defines if you are looking for an exact entry (is) or for any entry containing the searched value (contains). You can also search for an entry that starts with or ends with a certain value. The exact and broad search can be negative as well (is not and does not contain).

When you are searching for sources, you can use the following match types: is any of and is not any of. They enable you to specify multiple sources from the list and to search for changes in any of those sources, or in all sources except the selected ones, respectively.

When filtering events by time (the When filter), you can choose from the following match types: is today, is after, is before , is between for time range, and is in the last X days.

Value

The value field is the area where you specify a value to be searched. For example, the name of a user or a date range. Depending on the filter, you can select a value from the drop-down list or enter it manually.

You can adjust your search query at any time and remove entries you no longer need by clicking the red X next to that entry.

Show me example