Add Pure Storage add-on documentation

[TheNewCat777]

New docs for the Netwrix Auditor Add-on for Pure Storage (FlashArray File Auditing), modeled on the Nutanix AHV add-on structure (Wizard-based MSI install, syslog collection):

• overview.md - what the add-on does, prerequisites at a glance, delivery package.
• install.md - FlashArray-side setup (syslog log target, File Auditing policy, SACL via the Audit Operators group) and the Netwrix Wizard configuration walkthrough.
• monitoredevents.md - objects/actions/properties tracked (File/Folder, Added/Removed/Modified/Renamed/Moved + Failed Attempt variants).
• collecteddata.md - searching/subscribing/alerting on collected data in Auditor client.

[github-actions]

Documentation PR Review

Editorial Review

docs/auditor/10.9/addon/purestorage/overview.md

• Structure — Lines 29–30: "FlashArray with a File Auditing policy configured and a SACL set on the paths you want audited" is listed as a prerequisite, but install.md Step 2: Configure FlashArray File Auditing and Forwarding is the procedure that does exactly this. A reader following the prerequisites will go looking for array configuration instructions elsewhere, then find them in the deployment topic. Suggested fix: reduce the prerequisite to what must genuinely pre-exist ("Administrative access to a FlashArray running Purity//FA <version> or later, with File Auditing available") and let Step 2 own the policy and SACL configuration.
• Completeness — Lines 31–32: The prerequisites give no concrete, checkable requirements. Compare nasuni/overview.md, which specifies the Integration API port (TCP 9699), the .NET Framework version, the required Auditor role (Contributor), and the account the add-on runs under. Suggested fix: state the supported Windows Server versions, the .NET runtime requirement, the minimum Purity//FA version, the default Integration API port (9699), the default listener port (6514), and the Auditor role required to write to the Audit Database.
• Clarity — Line 29: SACL is used here on first mention and is never expanded anywhere in the add-on documentation set. The audience includes readers new to file auditing. Suggested fix: "a system access control list (SACL) set on the paths you want audited".
• Structure — Lines 9–12: The topic opens with a general description of the Netwrix Auditor platform ("a visibility platform for user behavior analysis and risk mitigation…") rather than what the Pure Storage add-on does. A reader who navigated to the Pure Storage page already knows what Auditor is. Suggested fix: lead with the paragraph at lines 14–18, then keep only a one-sentence platform reference if needed — as nasuni/overview.md does with "The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your Nasuni-based devices."
• Clarity — Lines 20–21: "with no additional share access required" conflicts with install.md lines 109–115, which describes an optional domain account used to read the audited share's ACL. Suggested fix: qualify the claim — "Event collection requires no share access; an optional domain account can be supplied to enrich events with owner and permission values. See Deploy the Add-On."
• Structure — Line 23: The pointer to the deployment topic appears before the Prerequisites and Add-on Delivery Package sections, sending the reader onward before they have read the requirements. Per the documented order (overview → prerequisites → procedures), the link belongs last. Suggested fix: move line 23 to the end of the topic.
• Completeness — Lines 36–38: The topic states the add-on ships as an MSI installer but never says where to obtain it, and install.md line 92 begins with "Run the MSI installer" on the same assumption. The reader has no path from "I want this add-on" to "I have the file." Suggested fix: name the download source, as sibling topics do ("Download the latest add-on version in the Add-on Store").
• Completeness — End of file: Sibling add-on overviews close with a Compatibility Notice advising readers to match the add-on version to their Auditor version. Its absence here leaves version compatibility unaddressed. Suggested fix: add the standard Compatibility Notice section.

docs/auditor/10.9/addon/purestorage/install.md

• Structure — Lines 96–118 conflict with lines 11–15 and the ## Step N: headings: the topic runs two independent "Step" sequences, and the inner wizard sequence restarts at Step 1 inside the outer Step 3. The cross-reference at line 33 — "specify this monitoring plan in the Monitoring Plan field in the add-on configuration wizard. See Step 3 below for details" — is ambiguous as a result: it means the outer Step 3 section, but the Monitoring Plan field is documented under the inner "Step 1 – Specify General settings," and an unrelated inner "Step 3 – Share and AD access account" also exists at that destination. Suggested fix: rename the inner sequence to wizard pages (for example, "Wizard page 1 – General settings") and change line 33 to "See Step 3: Install and Configure the Add-On below for details."
• Completeness — Lines 122–127: The section directs the reader to addonconfiguration.json for advanced tuning but gives no file location, no parameter names, no value syntax, and no example — so none of the described tuning ("choosing which shares or protocols a source should collect, excluding specific users or paths, or turning ACL enrichment on or off") is actionable. Sibling add-ons document this on a dedicated parameters.md topic, and sidebar_position: 20 is currently unused in this folder. Suggested fix: add a Define Parameters topic at position 20 documenting the file path and each parameter, and link to it from here.
• Completeness — Lines 50–55: The purelog syslog create example uses a <port> placeholder, but the reader configuring the array at this point has not yet reached line 105, where the default listener port (6514) is defined. Suggested fix: state the value inline — "…and the port the add-on will listen on (default: 6514; see Step 3 to change it)."
• Completeness — Lines 53–55: The syslog target uses tls://, but the topic never covers the certificate side of that connection — what certificate the add-on presents, whether it is self-signed or must be supplied, and whether the FlashArray must be configured to trust it. A reader following these steps exactly can end up with a target the array refuses to connect to. Suggested fix: add a short paragraph on certificate requirements before the purelog example, or link to the topic that covers it.
• Structure — Lines 45–48: The important information is a Markdown blockquote (> **Important:**) rather than a Docusaurus admonition, so it renders as quoted text instead of a callout and is visually inconsistent with the rest of the documentation set. Suggested fix: convert to :::warning … :::.
• Clarity — Line 42: "Managed Directory" is FlashArray-specific terminology, capitalized as a proper noun and used without definition. Readers who administer Auditor but not the array will not know what to attach the policy to. Suggested fix: define it on first use — "the Managed Directory (a FlashArray-managed directory within a file system) or directories you want audited" — or link to the Pure Storage documentation for the term.
• Completeness — Lines 129–131 and the topic as a whole: There is no verification or troubleshooting guidance for the add-on itself. Line 84 covers verifying that an array event reaches the syslog target, but nothing tells the reader how to confirm the add-on service started, that it is listening, or that activity records reached Auditor — and the callout at line 45 already anticipates "no data reaches the add-on" as a common outcome. Suggested fix: add a short "Verify the deployment" section (check the Windows service state, confirm the listener port, then search for the records in Auditor), following the pattern of nutanixahv/troubleshooting.md.
• Structure — Lines 129–131: The notes about NFS path reporting and SMB-only ACL enrichment are behavioral characteristics, not configuration, so they read oddly under Advanced Configuration; they also duplicate monitoredevents.md lines 25–29. Suggested fix: move them to a Considerations and Limitations section (the heading sibling overviews use) or remove them here and rely on the Monitoring Scope topic.
• Structure — Lines 37–43: The four-item workflow list promises a structure the topic then only partly delivers — items 1–3 are covered in unheaded prose, while item 4 gets its own ### Set the SACL heading. A reader scanning for "Create a File Auditing policy" finds no heading to land on. Suggested fix: give each of the four items a ### heading, or drop the numbered preview and let the prose flow.
• Structure — Line 50: "Both SMB and NFS are supported." is protocol-support information dropped between the warning callout and the syslog target instructions, interrupting the procedure. Suggested fix: move it to the introduction of Step 2 (after line 38) or to overview.md.
• Clarity — Line 30: "Target it at Netwrix API data source and enable for monitoring." The pronoun "it" is ambiguous after two preceding sentences that mention both the plan and the database, the article before "Netwrix API data source" is missing, and "enable for monitoring" has no object. Suggested fix: "Target the plan at the Netwrix API data source and enable the data source for monitoring."
• Clarity — Lines 69–71: "a privileged File user" uses a capitalized "File" that is never defined, so it reads as a typo rather than as the FlashArray user category it appears to be. Suggested fix: "a privileged FlashArray File user — by default, a member of the array's Audit Operators local group".
• Clarity — Line 109: "AD" is used before its expansion; "Active Directory" appears three lines later at line 112. Suggested fix: use "Active Directory" in the heading text at line 109, or spell it out on first use as "Active Directory (AD)".
• Consistency — Lines 15, 90, and 117: The product component is styled three different ways in one topic — "the Add-On" (line 15), "the Add-On" in the heading (line 90), and "Add-on configuration" (line 117) — while the surrounding prose uses lowercase "add-on". Suggested fix: standardize on "add-on" in sentence text and title-case only in headings.
• Clarity — Line 19: "go to the Integrations section" does not bold the UI element, unlike Leverage Integration API on the next line. Suggested fix: "go to the Integrations section".

docs/auditor/10.9/addon/purestorage/collecteddata.md

• Structure — Lines 15–16: This paragraph is placed between the first bullet and the second, splitting one logical list into two separate Markdown lists. The sibling nasuni/collecteddata.md has a screenshot in this position, which visually justifies the break; without it, the interruption just fragments the list and the second list restarts with "Also, you can…" as though continuing. Suggested fix: make it a sub-bullet under the Search bullet, or convert it to a :::tip block placed after the full list.
• Clarity — Lines 23 and 25: "To create an alert on the specific occurrences, click Create alert" and "You can also configure and receive alerts on the events you are interested in" tell the reader the same thing twice, and line 25 is the vaguer of the two. Suggested fix: delete line 25 and rely on the Alerts link at line 29.

docs/auditor/10.9/addon/purestorage/monitoredevents.md

• Completeness — Lines 17, 18, and 28: "ACL enrichment" gates three of the documented properties, but the term is never defined and the reader is never told where to enable or disable it. install.md line 124 mentions it in the same unexplained way. A reader who finds Owner empty in an activity record has no way to act on this. Suggested fix: define the term on first use and point to the setting — for example, "ACL enrichment (the add-on's lookup of the current share ACL to populate 'after' values, configured in addonconfiguration.json)".
• Structure — Line 21: This row bundles five distinct failed-attempt actions into one cell with a prose Property value ("Same properties as the corresponding successful action, for access-denied attempts"), breaking the one-action-per-row pattern the rest of the table establishes and producing a cell far wider than any other. Suggested fix: remove the row and add a note below the table: "Each action above is also monitored as a failed attempt (access denied), reported with the same properties."
• Clarity — Line 18: DACL is used without expansion and is the only place in the add-on documentation the term appears. Suggested fix: "Modified (permissions change, or DACL — discretionary access control list)", or use "permissions change" alone since the Property column already says "Permissions".

Summary

29 editorial suggestions across 4 files. Vale and Dale issues are auto-fixed separately.

The highest-value items are the two "Step 1/2/3" numbering schemes colliding in install.md (which makes the cross-reference at line 33 point somewhere misleading), the prerequisites in overview.md that restate an install step instead of listing checkable requirements, and the undocumented addonconfiguration.json parameters and "ACL enrichment" setting that several topics depend on but none explain.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

21 issues fixed, 5 skipped across 4 files

Category	Fixes
Contractions	1
Substitutions	1
Dale: idioms	1
Dale: passive-voice	14
Dale: positional-references	1
Dale: wordiness	2
Dale: xy-slop	1

Skipped (needs manual review)	Reason
docs/auditor/10.9/addon/purestorage/install.md:21 — Netwrix.Idioms	False positive: 'Leverage Integration API' is the literal name of a UI switch in the Auditor Integrations section, not idiomatic use of 'leverage'. The same UI label appears verbatim in ~15 other files (docs/auditor/10.9/api/prerequisites.md, docs/auditor/10.9/addon/hyperv/install.md, docs/auditor/10.9/addon/cyberark/deployment.md, and others). Rewording it would misname a real UI control and break accuracy.
docs/auditor/10.9/addon/purestorage/install.md:78 — Dale: minimizing-difficulty	'The simplest way to set the SACL is from an SMB client' recommends one method among several rather than claiming the task is easy; rewriting would drop the comparative guidance the author intended
docs/auditor/10.9/addon/purestorage/overview.md:9 — Dale: wordiness	Standard Netwrix Auditor product boilerplate reproduced verbatim in 5 other add-on overview topics; editing here would break cross-document consistency
docs/auditor/10.9/addon/purestorage/collecteddata.md:10 — Dale: wordiness	'Search for required data. For that, start Auditor client...' is shared boilerplate identical across 8 add-on collecteddata topics; editing only this copy would break consistency
docs/auditor/10.9/addon/purestorage/collecteddata.md:20 — Dale: wordiness	'If you want to periodically receive the report on the results of search with the specified criteria' is part of the same shared boilerplate block used across all add-on collecteddata topics

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Code Review

No correctness, security, or build-breaking issues found.

This PR is documentation-only — it adds five new files under docs/auditor/10.9/addon/purestorage/ and touches no code, config, scripts, or workflows. There are no changes to products.js, docusaurus.config.js, sidebars/, scripts/copy-kb-to-versions.mjs, or .github/workflows/.

Build / routing checks performed

• _category_.json — valid JSON; matches the sibling add-on convention exactly (link.type: doc with relative id: "overview", same as nutanixahv, ctera, nasuni). overview.md exists in the same directory, so the category link resolves.
• position: 175 — unique among the 25 sibling add-on categories (slots between privilegeduserlinux at 170 and radius at 190). No new collision introduced.
• sidebar_position values — install.md 10, collecteddata.md 30, monitoredevents.md 40, overview.md 175 — identical to the nutanixahv add-on they are modeled on.
• Sidebar registration — sidebars/auditor/10.9.js is {type: "autogenerated", dirName: "."}, so the new directory is picked up automatically. No manual sidebar edit is needed or missing.
• Cross-document links — all five link targets resolve to existing files, and the /docs/auditor/10.9/....md absolute-path form matches the existing convention in nutanixahv/: api/prerequisites.md, admin/alertsettings/overview.md, admin/search/overview.md, admin/subscriptions/overview.md, and addon/purestorage/install.md all exist.
• In-page anchor — the step-3-install-and-configure-the-add-on anchor added by the Vale autofix commit correctly matches the slug generated from the Step 3: Install and Configure the Add-On heading. This matters because the build sets onBrokenAnchors: "throw".
• No new product/version registration required — no references to sibling add-on directories exist outside docs/, so nothing needs to be added to src/config/products.js or the redirects config.
• No images referenced, so no missing static/images/ assets.
• Secrets / injection — nothing applicable; the shell snippets are illustrative purelog/purepolicy/pureds commands with placeholder values, no real credentials or hosts.

One minor note (factual consistency, not style)

overview.md states the add-on "requires no additional share access," but install.md Step 3 and monitoredevents.md describe an optional domain account used to read the audited share ACL for owner/permissions enrichment. Both can be true (the account is optional), but the overview reads as an absolute. Worth a small qualifier such as "no additional share access is required for event collection." Flagging this as a factual contradiction rather than a style point — leaving the wording to the editorial workflow.